Threat briefs

CVE-2026-7451 is an out-of-bounds write vulnerability in Autodesk 3ds Max that can be exploited via a maliciously crafted TIF file, potentially leading to a crash, data corruption, or arbitrary code execution.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request (CVE-2026-8633).

Typebot is vulnerable to stored cross-site scripting (XSS) due to the rating block's custom icon feature, which accepts arbitrary HTML/SVG via the `customIcon.svg` field without sanitization. When a malicious typebot is imported or crafted by a workspace collaborator, the payload executes in the builder's DOM context, bypassing the `isUnsafe` Web Worker sandbox that protects Script blocks during preview, allowing session hijacking and privilege escalation within the builder application.

A SQL injection vulnerability (CVE-2026-9552) exists in Das Parking Management System 6.2.0 within the Search API Endpoint, allowing a remote attacker to execute arbitrary SQL commands by manipulating the 'Value' argument.

A SQL injection vulnerability exists in Das Parking Management System 停车场管理系统 version 6.2.0 allowing a remote attacker to execute arbitrary SQL commands by manipulating the Value argument in the xp_cmdshell function of the ParkingRecord/ExportParkingRecords API endpoint.

A path traversal vulnerability (CVE-2026-9550) exists in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0, allowing remote attackers to access sensitive files by manipulating the path argument in the /SubstationWEBV2/app/..;/main/upfile component.

CVE-2026-4480 allows a remote attacker to achieve remote code execution on a vulnerable Samba server by sending a specially crafted print job description containing unescaped shell metacharacters, which are then passed to the configured 'print command'.

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability (CVE-2026-45247) that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.

CVE-2026-47668 is a critical remote code execution vulnerability affecting DbGate versions 7.1.8 and earlier in the JSON Script Runner component where user-controlled fields are concatenated into dynamically generated JavaScript without adequate validation, allowing arbitrary code execution, and an attacker may obtain a Bearer token and reach the vulnerable endpoint without valid credentials leading to full server compromise; upgrade to DbGate 7.1.9+ immediately to remediate the vulnerability.

A public exploit is available for WordPress Temporary Login Plugin version 1.0.0, which demonstrates an authentication bypass vulnerability that can lead to account takeover, increasing the risk for unpatched systems.

A hardware exploit has been published on Exploit-DB for D-Link DSL2600U, detailing a 'rom-0' Admin Password Disclosure vulnerability that allows unauthorized access to the device's administration interface.

A local privilege escalation exploit has been published for Linux Kernel 6.8 on Exploit-DB, posing a significant risk to unpatched systems.

A stack-based buffer overflow vulnerability (CVE-2026-9481) exists in the formStats function of the /goform/formStats file in Edimax EW-7438RPn version 1.31, allowing a remote attacker to execute arbitrary code by manipulating the submit-url argument.

Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formLicence function of the /goform/formLicence file, allowing remote attackers to execute arbitrary code by manipulating the submit-url argument; a public exploit is available.

A vulnerability, CVE-2025-11482, exists in ABB's PPT30 Operating System related to handling concurrent connections in the PPT30 OPC-UA Server, affecting versions prior to 1.8.0.

A SQL injection vulnerability exists in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10 in the /api/Dinner/PayConfig endpoint, where a remote attacker can manipulate the 'tableno' argument to inject arbitrary SQL commands.

itsourcecode Electronic Judging System 1.0 is vulnerable to SQL injection via the judge_id parameter in /admin/delete_judge.php, allowing remote attackers to execute arbitrary SQL queries.

A SQL injection vulnerability exists in itsourcecode Electronic Judging System version 1.0, specifically affecting the /admin/edit_team.php file, where an attacker can remotely manipulate the 'num_id' argument to execute arbitrary SQL commands.

A SQL Injection vulnerability exists in itsourcecode Electronic Judging System version 1.0 in the /admin/edit_judge.php file. By manipulating the judge_id argument, an attacker could execute arbitrary SQL commands on the system. The vulnerability can be triggered remotely and has a public exploit available.

A SQL injection vulnerability (CVE-2026-9523) exists in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2, where manipulating the 'sort' argument in the '/SubstationWEBV2/app/..;/calc/getCalcmeterDetailDayListTree' file leads to remote code execution, and is publicly known and actively exploited.

A remote code execution vulnerability exists in fraillt bitsery versions up to 5.2.4 due to improper validation of input in the `loadFromSharedState` function, potentially leading to arbitrary code execution.

A vulnerability in hemant6488 CodeIgniter-StudentManagementSystem allows remote attackers to perform improper access controls by manipulating the /index.php/students/addStudentView file, with a publicly available exploit and no vendor response.

A SQL injection vulnerability (CVE-2026-9474) exists in the StudentManagementSystem application, specifically affecting the confirm_logged_in function within the /studentdel.php file, allowing remote attackers to execute arbitrary SQL commands by manipulating the ID parameter.

A SQL injection vulnerability exists in the /success.php file of yashpokharna2555 StudentManagementSystem, allowing remote attackers to execute arbitrary SQL commands by manipulating the User argument.

Tiandy Easy7 Integrated Management Platform 7.17.0 is vulnerable to SQL injection (CVE-2026-9465) via manipulation of the strTBName argument in /Easy7/apps/WebService/GetDBDataEx.jsp, allowing a remote attacker to execute arbitrary SQL commands.

Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow (CVE-2026-9462) in the `formWpsProxyEnable` function of `/goform/formWpsProxyEnable`, triggered by manipulating the `submit-url` argument, allowing remote attackers to execute arbitrary code; a public exploit is available.

Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability, allowing authenticated attackers to execute arbitrary SQL commands through crafted POST requests.

CVE-2026-9421 is an unrestricted file upload vulnerability in the File Handler component of KLiK SocialMediaWebsite 1.0 that can be exploited remotely.

CVE-2026-7374 allows an authenticated OpenShift user with edit permissions in a single namespace to escalate privileges to full cluster control by exploiting improper symlink validation in KubeVirt's virt-handler component when connecting to VM console sockets.

The Red Canary Intelligence Insights report for May 2026 highlights the rise of ClearFake, ACR Stealer, and GraphRunner, with ClearFake using JavaScript injection to deliver malware like ACR Stealer, and GraphRunner being abused for reconnaissance and data exfiltration via the Microsoft Graph API.