April 2026 (30)
Adobe ColdFusion Improper Input Validation RCE
2 rules 1 TTP 1 CVEAdobe ColdFusion versions 2023.18, 2025.6, and earlier are vulnerable to improper input validation, potentially leading to arbitrary code execution without user interaction.
Adobe ColdFusion Improper Input Validation Vulnerability (CVE-2026-27306)
2 rules 1 TTP 1 CVEAn improper input validation vulnerability in Adobe ColdFusion versions 2023.18, 2025.6, and earlier (CVE-2026-27306) could lead to arbitrary code execution if a privileged user opens a specially crafted malicious file.
Adobe ColdFusion Path Traversal Vulnerability (CVE-2026-34619)
2 rules 1 TTP 1 CVEA path traversal vulnerability (CVE-2026-34619) in Adobe ColdFusion versions 2023.18, 2025.6, and earlier allows an attacker to bypass security features and access unauthorized files or directories without user interaction.
Adobe InDesign Heap-Based Buffer Overflow Vulnerability (CVE-2026-34629)
2 rules 2 TTPs 1 CVEAdobe InDesign versions 20.5.2, 21.2 and earlier are vulnerable to a heap-based buffer overflow (CVE-2026-34629) that could lead to arbitrary code execution if a user opens a malicious file.
Adobe Photoshop Out-of-Bounds Read Vulnerability (CVE-2026-27289)
2 rules 3 TTPs 1 CVEAn out-of-bounds read vulnerability (CVE-2026-27289) in Adobe Photoshop Desktop versions 27.4 and earlier allows for potential code execution via a crafted file, requiring user interaction to trigger the exploit.
Autodesk Fusion Stored XSS Vulnerability (CVE-2026-4344)
2 rules 3 TTPs 1 CVE 3 IOCsCVE-2026-4344 is a stored cross-site scripting (XSS) vulnerability in the Autodesk Fusion desktop application where a malicious HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can lead to arbitrary code execution.
Azure Monitor Agent Deserialization Vulnerability (CVE-2026-32192) Allows Local Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32192 allows a locally authorized attacker to escalate privileges on a host running the Azure Monitor Agent via deserialization of untrusted data.
Azure Monitor Agent Improper Input Validation Vulnerability (CVE-2026-32168)
2 rules 1 TTP 1 CVECVE-2026-32168 is an improper input validation vulnerability in Azure Monitor Agent that allows a locally authorized attacker to elevate privileges.
Chamilo LMS Unauthenticated SSRF Vulnerability
2 rules 1 TTP 1 CVE 1 IOCAn unauthenticated server-side request forgery (SSRF) vulnerability exists in Chamilo LMS versions prior to 2.0.0-RC.3, allowing attackers to probe internal network services, access cloud metadata, or trigger state-changing operations on internal services.
Composer Command Injection via Malicious Perforce Repository
2 rules 1 TTPComposer is vulnerable to command injection via a malicious Perforce repository due to improper escaping of user-supplied Perforce connection parameters, potentially leading to arbitrary command execution in the context of the user running Composer.
Critical Remote Code Execution Vulnerability in Talend JobServer and Talend Runtime
2 rules 2 TTPs 1 CVECVE-2026-6264, a critical deserialization vulnerability in Talend JobServer and Runtime, allows unauthenticated remote code execution via the JMX monitoring port, leading to complete system compromise.
CVE-2026-26152: Windows Cryptographic Services Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26152 is an insecure storage of sensitive information vulnerability in Windows Cryptographic Services that allows a local, authorized attacker to elevate privileges.
CVE-2026-26153: Windows EFS Out-of-Bounds Read Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26153 is an out-of-bounds read vulnerability in the Windows Encrypting File System (EFS) that allows an authorized local attacker to elevate privileges.
CVE-2026-26163: Windows Kernel Double Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26163 is a double free vulnerability in the Windows Kernel, allowing an authorized attacker to elevate privileges locally with a CVSS v3.1 score of 7.8.
CVE-2026-26179 Windows Kernel Double Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26179 is a double free vulnerability in the Windows Kernel, allowing a locally authenticated attacker to elevate privileges on the system.
CVE-2026-26181 - Microsoft Brokering File System Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-26181 is a use-after-free vulnerability in the Microsoft Brokering File System that enables a locally authenticated attacker to escalate privileges on the system.
CVE-2026-26182: Windows WinSock Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-26182 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, allowing a locally authorized attacker to elevate privileges.
CVE-2026-27908 Use-After-Free in Windows TDI Translation Driver
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-27908, exists in the Windows TDI Translation Driver (tdx.sys), allowing a locally authenticated attacker to elevate privileges.
CVE-2026-27909 Use-After-Free in Windows Search Component Allows Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-27909 is a use-after-free vulnerability in the Microsoft Windows Search Component that allows a locally authorized attacker to escalate privileges.
CVE-2026-27910: Windows Installer Local Privilege Escalation
2 rules 1 TTP 1 CVE 1 IOCCVE-2026-27910 describes a local privilege escalation vulnerability in Windows Installer due to improper handling of insufficient permissions, allowing an authorized attacker to gain elevated privileges.
CVE-2026-27916 Use-After-Free in Windows UPnP Device Host
2 rules 1 TTP 1 CVECVE-2026-27916 is a use-after-free vulnerability in Windows Universal Plug and Play (UPnP) Device Host that allows an authorized attacker to elevate privileges locally.
CVE-2026-27917: Windows WFP NDIS Lightweight Filter Driver Use-After-Free Vulnerability
2 rules 1 TTP 1 CVECVE-2026-27917 is a use-after-free vulnerability in the Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) that allows a locally authorized attacker to elevate privileges.
CVE-2026-27926 Windows Cloud Files Mini Filter Driver Privilege Escalation
3 rules 1 TTP 1 CVECVE-2026-27926 is a race condition vulnerability in the Windows Cloud Files Mini Filter Driver that allows a local attacker to elevate privileges.
CVE-2026-32071: Windows LSASS Null Pointer Dereference DoS
2 rules 1 TTP 1 CVECVE-2026-32071 is a null pointer dereference vulnerability in the Windows Local Security Authority Subsystem Service (LSASS), allowing an unauthorized network attacker to cause a denial-of-service condition.
CVE-2026-32078: Windows Projected File System Use-After-Free Elevation of Privilege
2 rules 1 TTP 1 CVEA use-after-free vulnerability, CVE-2026-32078, exists in the Windows Projected File System, allowing a locally authenticated attacker to escalate privileges.
CVE-2026-32152 Use-After-Free in Desktop Window Manager
2 rules 1 TTP 1 CVECVE-2026-32152 is a use-after-free vulnerability in the Desktop Window Manager (dwm.exe) that allows an authorized local attacker to elevate privileges.
CVE-2026-32155: Desktop Window Manager Use-After-Free Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32155 is a use-after-free vulnerability in the Desktop Window Manager that allows an authorized attacker to escalate privileges locally on a Windows system.
CVE-2026-32157 - Remote Desktop Client Use-After-Free Vulnerability
2 rules 2 TTPs 1 CVECVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network.
CVE-2026-32164 Windows User Interface Core Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32164 is a race condition vulnerability in Windows User Interface Core that allows a locally authorized attacker to elevate privileges.
CVE-2026-32195 Windows Kernel Stack-Based Buffer Overflow Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32195 is a stack-based buffer overflow vulnerability in the Windows Kernel that allows an authorized attacker to elevate privileges locally.