April 2026 (30)
CVE-2026-32152 Use-After-Free in Desktop Window Manager
2 rules 1 TTP 1 CVECVE-2026-32152 is a use-after-free vulnerability in the Desktop Window Manager (dwm.exe) that allows an authorized local attacker to elevate privileges.
CVE-2026-32155: Desktop Window Manager Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32155 is a use-after-free vulnerability in the Desktop Window Manager that allows an authorized attacker to escalate privileges locally on a Windows system.
CVE-2026-32157 - Remote Desktop Client Use-After-Free Vulnerability
2 rules 2 TTPs 1 CVECVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network.
CVE-2026-32164 Windows User Interface Core Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32164 is a race condition vulnerability in Windows User Interface Core that allows a locally authorized attacker to elevate privileges.
CVE-2026-32195 Windows Kernel Stack-Based Buffer Overflow Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32195 is a stack-based buffer overflow vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges locally.
CVE-2026-33096 HTTP.sys Out-of-Bounds Read Denial-of-Service
2 rules 2 TTPs 1 CVEAn unauthenticated, remote attacker can exploit an out-of-bounds read vulnerability (CVE-2026-33096) in Windows HTTP.sys to cause a denial-of-service condition.
CVE-2026-33098 Use-After-Free in Windows Container Isolation FS Filter Driver
2 rules 1 TTP 1 CVECVE-2026-33098 is a use-after-free vulnerability in the Windows Container Isolation FS Filter Driver that allows a locally authorized attacker to elevate privileges.
CVE-2026-33099: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-33099, in the Windows Ancillary Function Driver for WinSock, enables a locally authenticated attacker to elevate privileges on the system.
CVE-2026-33101 Use-After-Free Vulnerability in Windows Print Spooler
2 rules 1 TTP 1 CVECVE-2026-33101 is a use-after-free vulnerability in the Windows Print Spooler Components that allows an authenticated local attacker to elevate privileges.
CVE-2026-33824: Windows IKE Extension Double Free Vulnerability
2 rules 3 TTPs 1 CVEA double free vulnerability in the Windows IKE Extension, tracked as CVE-2026-33824, allows an unauthenticated remote attacker to execute arbitrary code over the network.
CVE-2026-33826: Windows Active Directory Improper Input Validation Vulnerability
2 rules 1 TTP 1 CVEAn improper input validation vulnerability (CVE-2026-33826) in Windows Active Directory could allow an authenticated attacker on an adjacent network to execute code.
Fortinet FortiDDoS-F SQL Injection Vulnerability (CVE-2026-39815)
2 rules 3 TTPs 1 CVEAn SQL injection vulnerability (CVE-2026-39815) in Fortinet FortiDDoS-F versions 7.2.1 through 7.2.2 may allow a low-privilege attacker to execute unauthorized code or commands.
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)
2 rules 1 TTP 1 CVEFortinet FortiSandbox versions 4.4.0 through 4.4.8 are vulnerable to OS Command Injection (CVE-2026-39808), potentially allowing unauthenticated attackers to execute arbitrary code or commands.
Go Markdown Library Out-of-Bounds Read Vulnerability
2 rules 1 TTPA vulnerability in the go-markdown library exists where processing a malformed input containing a '<' character that is not followed by a '>' character with a SmartypantsRenderer can lead to an out-of-bounds read or a panic, causing a denial of service.
Jetty HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
2 rules 1 TTP 1 CVE 2 IOCsJetty is vulnerable to HTTP request smuggling due to improper parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values, potentially allowing attackers to inject arbitrary HTTP requests, poison caches, and bypass security controls.
Krayin CRM v2.2.x SQL Injection Vulnerability
2 rules 1 TTP 1 CVEKrayin CRM v2.2.x is vulnerable to SQL injection via the rotten_lead parameter in /Lead/LeadDataGrid.php, potentially allowing attackers to read sensitive data.
Libsixel Use-After-Free Vulnerability (CVE-2026-33018)
2 rules 1 TTP 1 CVEA use-after-free vulnerability exists in libsixel versions 1.8.7 and prior when processing animated GIFs due to improper frame buffer management, potentially leading to code execution.
manikandan580 School-management-system SQL Injection Vulnerability
2 rules 1 TTP 1 CVEA time-based blind SQL injection vulnerability in manikandan580 School-management-system 1.0 allows unauthenticated attackers to potentially execute arbitrary SQL queries and gain unauthorized access to sensitive information.
Microsoft Defender Privilege Escalation Vulnerability (CVE-2026-33825)
2 rules 1 TTP 1 CVECVE-2026-33825 allows a locally authenticated attacker to escalate privileges in Microsoft Defender due to insufficient access control granularity.
Microsoft Excel Out-of-Bounds Read Vulnerability (CVE-2026-32188)
2 rules 1 TTP 1 CVEAn out-of-bounds read vulnerability in Microsoft Office Excel (CVE-2026-32188) allows a local attacker to potentially disclose sensitive information through a maliciously crafted Excel file.
Microsoft Excel Use-After-Free Vulnerability (CVE-2026-32189)
2 rules 1 TTP 1 CVECVE-2026-32189 is a use-after-free vulnerability in Microsoft Excel that allows a local attacker to execute arbitrary code by exploiting memory corruption.
Microsoft Management Console Improper Access Control Vulnerability (CVE-2026-27914)
2 rules 1 TTP 1 CVECVE-2026-27914 is an improper access control vulnerability in Microsoft Management Console that allows a locally authorized attacker to elevate privileges.
Microsoft Office Excel Use-After-Free Vulnerability (CVE-2026-32198)
3 rules 1 TTP 1 CVECVE-2026-32198 is a use-after-free vulnerability in Microsoft Office Excel that allows an attacker to execute code locally on a vulnerable system.
Microsoft Office Word Use-After-Free Vulnerability (CVE-2026-33095)
2 rules 1 TTP 1 CVEA use-after-free vulnerability in Microsoft Office Word (CVE-2026-33095) could allow a local attacker to execute arbitrary code by opening a specially crafted document.
Microsoft PowerShell Improper Input Validation Vulnerability (CVE-2026-26143)
2 rules 1 TTP 1 CVEAn improper input validation vulnerability (CVE-2026-26143) in Microsoft PowerShell allows an unauthorized local attacker to bypass security features.
Microsoft Word Use-After-Free Vulnerability CVE-2026-23657
2 rules 1 TTP 1 CVECVE-2026-23657 is a use-after-free vulnerability in Microsoft Office Word allowing a local attacker to execute arbitrary code with user privileges.
OAuth2 Proxy Authentication Bypass via User-Agent Header
2 rules 1 TTPA critical authentication bypass vulnerability (CVE-2026-34457) exists in OAuth2 Proxy when used with `auth_request`-style integration and either `--ping-user-agent` is set or `--gcp-healthchecks` is enabled, allowing unauthenticated access to protected resources.
SQL Server Untrusted Pointer Dereference Vulnerability (CVE-2026-33120)
2 rules 1 TTP 1 CVECVE-2026-33120 is an untrusted pointer dereference vulnerability in Microsoft SQL Server that allows an authenticated attacker to achieve remote code execution over a network.
Webkul Krayin CRM SSRF Vulnerability (CVE-2026-38527)
2 rules 1 TTP 1 CVEA Server-Side Request Forgery (SSRF) vulnerability in Webkul Krayin CRM v2.2.x allows attackers to scan internal resources by sending a crafted POST request to the /settings/webhooks/create endpoint.
Windows BitLocker Security Feature Bypass Vulnerability (CVE-2026-27913)
2 rules 1 TTP 1 CVECVE-2026-27913 describes an improper input validation vulnerability in Windows BitLocker that allows a local attacker to bypass security features.