Security Digest: May 26, 2026 - 67 Critical Vulnerabilities

Today’s alert is high risk: 67 critical vulnerabilities span remote code execution, SQL injection, authentication bypass, XSS, and exposed admin functions across CRM, industrial, server, and security products. The most urgent items are CVE-2026-46624 in Twenty CRM, CVE-2026-7251 in Eppendorf BioFlo 320, CVE-2026-44668 in FACTION, and multiple IBM, NVIDIA, and Algernon flaws that can expose systems or hand attackers code execution.

· 32 min read

Executive Summary

Today’s alert is high risk: 67 critical vulnerabilities span remote code execution, SQL injection, authentication bypass, XSS, and exposed admin functions across CRM, industrial, server, and security products. The most urgent items are CVE-2026-46624 in Twenty CRM, CVE-2026-7251 in Eppendorf BioFlo 320, CVE-2026-44668 in FACTION, and multiple IBM, NVIDIA, and Algernon flaws that can expose systems or hand attackers code execution.

Act now: patch internet-facing systems first, disable exposed remote management features, and treat any unpatched instance of the affected products as potentially compromised until verified.

Critical Vulnerabilities

  • CVE-2026-46624: Twenty CRM RCE via SQL injection and PostgreSQL COPY TO PROGRAM
    • Impact: Authenticated attackers can run arbitrary OS commands on the database server.
    • Affected Systems: Twenty CRM 1.7.7 through 1.16.7.
    • Immediate Action: Remove public access to the CRM, restrict database privileges, and patch immediately.
    • Mitigation: Upgrade to a fixed release; verify Postgres users are not superuser where possible.
  • CVE-2026-7251: Eppendorf BioFlo 320 hard-coded VNC password
    • Impact: Remote attackers can take full control of the UI and operating controls.
    • Affected Systems: BioFlo 320 units with remote access enabled.
    • Immediate Action: Disable VNC and isolate affected equipment from untrusted networks.
    • Mitigation: Apply vendor guidance; assume VNC traffic is exposed if enabled.
  • CVE-2026-44668: FACTION auth bypass on all Struts2 actions
    • Impact: Unauthenticated attackers can read, overwrite, deactivate, or delete templates.
    • Affected Systems: FACTION prior to 1.8.3.
    • Immediate Action: Upgrade to 1.8.3 immediately and restrict access until patched.
    • Mitigation: Deploy the fixed version and review template integrity.
  • CVE-2026-8633: IBM Web Server Plug-ins RCE
    • Impact: Crafted requests can trigger remote code execution.
    • Affected Systems: IBM Web Server Plug-ins for WebSphere Application Server and Liberty 8.5/9.0.
    • Immediate Action: Patch all exposed IBM web plug-in deployments now.
    • Mitigation: Follow IBM’s advisory and verify no vulnerable plug-ins remain in front of public apps.
  • CVE-2026-3660: IBM ELM server property file update flaw
    • Impact: Unauthenticated attackers may gain unauthorized access.
    • Affected Systems: IBM ELM 7.0.3 through IF021, 7.1.0 through IF009, 7.2.0 through IF001.
    • Immediate Action: Restrict network exposure and patch immediately.
    • Mitigation: Upgrade to the latest fixed interim fix or release.
  • CVE-2026-45247: Mirasvit Full Page Cache Warmer PHP object injection
    • Impact: Unauthenticated remote code execution on Magento servers.
    • Affected Systems: Full Page Cache Warmer for Magento 2 before 1.11.12.
    • Immediate Action: Remove or disable the extension until updated.
    • Mitigation: Upgrade to 1.11.12 or later and review for suspicious serialized input.
  • CVE-2026-9642: DIAView database access bypass
    • Impact: Remote attackers can access configured databases.
    • Affected Systems: DIAView projects affected by the incomplete fix for CVE-2025-62582.
    • Immediate Action: Treat the earlier fix as insufficient and reapply vendor patches.
    • Mitigation: Update to the vendor’s corrected release and restrict remote access.
  • CVE-2026-9543: Totolink N300RH command injection
    • Impact: Remote OS command execution through web management.
    • Affected Systems: Totolink N300RH 6.1c.1353_B20190305.
    • Immediate Action: Remove from internet exposure and replace or patch immediately.
    • Mitigation: Apply firmware updates if available; otherwise isolate the device.
  • CVE-2026-44451: Lumiverse component override RCE
    • Impact: Malicious theme packs can execute code in the builder session.
    • Affected Systems: Lumiverse prior to 0.9.7.
    • Immediate Action: Block untrusted theme imports and upgrade now.
    • Mitigation: Deploy 0.9.7 and audit imported packs.
  • CVE-2026-44449: Lumiverse SMB command injection
    • Impact: Attacker-controlled paths can trigger host command execution.
    • Affected Systems: Lumiverse prior to 0.9.7.
    • Immediate Action: Restrict file-processing inputs and patch immediately.
    • Mitigation: Upgrade to 0.9.7.
  • CVE-2026-44444: Lumiverse Spindle extension install-time code execution
    • Impact: A malicious extension can run host commands during install.
    • Affected Systems: Lumiverse prior to 0.9.7.
    • Immediate Action: Pause extension installs until patched.
    • Mitigation: Upgrade to 0.9.7 and review extension sources.
  • CVE-2026-45721: Algernon directory traversal to handler.lua execution
    • Impact: Pre-authenticated remote code execution.
    • Affected Systems: Algernon prior to 1.17.7.
    • Immediate Action: Patch immediately and search for unexpected handler.lua files.
    • Mitigation: Upgrade to 1.17.7.
  • CVE-2026-44832: Snipe-IT privilege escalation
    • Impact: Users with edit rights can grant themselves admin.
    • Affected Systems: Snipe-IT prior to 8.4.1.
    • Immediate Action: Review user permissions and upgrade now.
    • Mitigation: Apply 8.4.1 and audit for unauthorized admin changes.
  • CVE-2026-24187: NVIDIA Linux driver use-after-free
    • Impact: Crash, privilege escalation, data tampering, or code execution.
    • Affected Systems: NVIDIA Display Driver for Linux.
    • Immediate Action: Prioritize workstation and server driver updates.
    • Mitigation: Install the vendor’s patched driver package.
  • CVE-2026-40033: FreeRDP heap overflow
    • Impact: Malicious RDP servers can crash clients or potentially execute code.
    • Affected Systems: FreeRDP before 3.26.0.
    • Immediate Action: Update all RDP clients and limit untrusted RDP connections.
    • Mitigation: Upgrade to 3.26.0 or later.
  • CVE-2026-44729: Twenty CRM file-serving XSS
    • Impact: Uploaded HTML can run in the CRM origin and steal sessions.
    • Affected Systems: Twenty CRM 1.18.0 and earlier.
    • Immediate Action: Block risky uploads and patch immediately.
    • Mitigation: Upgrade to a fixed release and review stored files.
  • CVE-2026-28445: Typebot rating icon XSS/RCE path
    • Impact: Malicious typebots can hijack builder sessions.
    • Affected Systems: npm @typebot.io/js.
    • Immediate Action: Stop importing untrusted bots and update packages.
    • Mitigation: Apply the vendor fix and sanitize HTML rendering.
  • CVE-2026-44669: FACTION stored XSS in attachment filenames
    • Impact: Persistent script execution in other users’ browsers.
    • Affected Systems: FACTION prior to 1.8.3.
    • Immediate Action: Patch and inspect uploaded attachment names.
    • Mitigation: Upgrade to 1.8.3.
  • CVE-2026-44667: FACTION stored XSS in remediation previews
    • Impact: Attackers can run JavaScript in privileged user sessions.
    • Affected Systems: FACTION prior to 1.8.3.
    • Immediate Action: Update immediately and review affected file previews.
    • Mitigation: Upgrade to 1.8.3.
  • CVE-2026-45298: Dozzle unauthenticated webhook test endpoint
    • Impact: Attackers can trigger outbound requests and read response bodies.
    • Affected Systems: Dozzle prior to 10.5.2 in default deployments.
    • Immediate Action: Restrict or disable the endpoint until patched.
    • Mitigation: Upgrade to 10.5.2 and enforce authentication.
  • CVE-2026-4480: Samba print command injection
    • Impact: Remote code execution via crafted print job descriptions.
    • Affected Systems: Samba printing subsystem with print command configured.
    • Immediate Action: Disable vulnerable print-command configurations now.
    • Mitigation: Apply vendor fixes and remove shell-based print commands.
  • CVE-2026-44706: Chatwoot SQL injection in filters
    • Impact: Authenticated attackers can extract or alter database data.
    • Affected Systems: Chatwoot 2.2.0 through before 4.11.2.
    • Immediate Action: Patch and monitor account-level filter usage.
    • Mitigation: Upgrade to 4.11.2.
  • CVE-2026-48126: Algernon Host header path escape
    • Impact: File read, directory listing, and possible Lua execution.
    • Affected Systems: Algernon prior to 1.17.8 when started with --domain or --letsencrypt.
    • Immediate Action: Remove exposed deployments from untrusted networks.
    • Mitigation: Upgrade to 1.17.8.
  • CVE-2026-8890: code100x mobile API auth bypass
    • Impact: Unauthenticated attackers can impersonate users.
    • Affected Systems: code100x Mobile API.
    • Immediate Action: Block access to the mobile API and patch.
    • Mitigation: Apply the vendor fix and audit identity headers.
  • CVE-2026-8855: IBM HTTP Server TLS mutual auth RCE/DoS
    • Impact: Remote code execution or denial of service.
    • Affected Systems: IBM HTTP Server 8.5 and 9.0 with client auth.
    • Immediate Action: Review TLS client-auth deployments and patch now.
    • Mitigation: Apply IBM updates.
  • CVE-2026-43935: e107 password reset host header injection
    • Impact: Password reset links can be redirected to attacker domains.
    • Affected Systems: e107 prior to 2.3.4.
    • Immediate Action: Patch and validate reset-link host handling.
    • Mitigation: Upgrade to 2.3.4.
  • CVE-2026-45574: epa4all-client TLS MITM exposure
    • Impact: Attackers can intercept SOAP traffic and sensitive identifiers.
    • Affected Systems: epa4all-client prior to 1.2.2.
    • Immediate Action: Restrict network path exposure and update.
    • Mitigation: Upgrade to 1.2.2.
  • CVE-2026-24190: NVIDIA Windows/Linux kernel mode flaw
    • Impact: Privilege escalation, data tampering, or code execution.
    • Affected Systems: NVIDIA Display Driver for Windows and Linux.
    • Immediate Action: Patch endpoints and servers using NVIDIA drivers.
    • Mitigation: Install the vendor’s fixed release.
  • CVE-2026-40034: gix-submodule command injection
    • Impact: Arbitrary shell commands during submodule update.
    • Affected Systems: gix-submodule before 0.82.0.
    • Immediate Action: Update build dependencies and review git workflows.
    • Mitigation: Upgrade to 0.82.0.
  • CVE-2026-7454: Autodesk 3ds Max WRL memory corruption
    • Impact: Crafted files can execute code in the current process.
    • Affected Systems: Autodesk 3ds Max.
    • Immediate Action: Treat untrusted model files as dangerous and patch.
    • Mitigation: Apply Autodesk updates.
  • CVE-2026-24162: NVIDIA Transformers4Rec deserialization flaw
    • Impact: Code execution, tampering, or information disclosure.
    • Affected Systems: NVIDIA Transformers4Rec for Linux.
    • Immediate Action: Stop processing untrusted serialized data.
    • Mitigation: Update to the fixed package.
  • CVE-2026-7451: Autodesk 3ds Max TIF out-of-bounds write
    • Impact: Crash, corruption, or arbitrary code execution.
    • Affected Systems: Autodesk 3ds Max.
    • Immediate Action: Patch and restrict untrusted image imports.
    • Mitigation: Apply vendor fixes.
  • CVE-2026-24192: NVIDIA Linux numeric conversion heap overflow
    • Impact: Denial of service, privilege escalation, or code execution.
    • Affected Systems: NVIDIA Display Driver for Linux.
    • Immediate Action: Prioritize driver updates on Linux fleets.
    • Mitigation: Install the patched release.
  • CVE-2026-24194: NVIDIA Linux permission handling flaw
    • Impact: Improper access control may enable escalation or code execution.
    • Affected Systems: NVIDIA Display Driver for Linux.
    • Immediate Action: Patch affected Linux systems immediately.
    • Mitigation: Upgrade to the fixed driver.
  • CVE-2026-7452: Autodesk 3ds Max WRL memory corruption
    • Impact: Arbitrary code execution in the current process.
    • Affected Systems: Autodesk 3ds Max.
    • Immediate Action: Restrict file intake from untrusted sources.
    • Mitigation: Apply Autodesk’s patch.
  • CVE-2026-25112: Genetec RabbitMQ privilege escalation
    • Impact: Attackers can gain elevated privileges.
    • Affected Systems: Genetec RabbitMQ deployment.
    • Immediate Action: Review administrative access and patch.
    • Mitigation: Apply the vendor update.
  • CVE-2026-24193: NVIDIA Windows/Linux out-of-bounds write
    • Impact: Crash, privilege escalation, or code execution.
    • Affected Systems: NVIDIA Display Driver for Windows and Linux.
    • Immediate Action: Update GPU drivers across all endpoints.
    • Mitigation: Install the fixed package.
  • CVE-2026-45082: Karakeep SSRF bypass
    • Impact: Authenticated users can force requests into internal Docker services.
    • Affected Systems: Karakeep prior to 0.32.0.
    • Immediate Action: Patch and restrict crawler/download features.
    • Mitigation: Upgrade to 0.32.0.
  • CVE-2026-48134: UserCheck DLP portal input handling issue
    • Impact: Incident data disruption and approval workflow problems.
    • Affected Systems: UserCheck Web Portal when DLP is active.
    • Immediate Action: Limit portal exposure from untrusted networks.
    • Mitigation: Apply vendor guidance and updates.
  • CVE-2026-44905: Vanetza parsing crash
    • Impact: Crafted V2X messages can terminate the process.
    • Affected Systems: Vanetza 26.02 and earlier.
    • Immediate Action: Patch any V2X processing nodes now.
    • Mitigation: Apply the fixed commit or release.
  • CVE-2026-24212: NVIDIA Isaac Launchable clear-text transmission
    • Impact: Sensitive information may be exposed in transit.
    • Affected Systems: NVIDIA Isaac Launchable for Linux.
    • Immediate Action: Restrict network paths and patch.
    • Mitigation: Apply the vendor fix.
  • CVE-2026-8620: IBM Web Server Plug-ins request smuggling
    • Impact: Request smuggling can undermine front-end security controls.
    • Affected Systems: IBM Web Server Plug-ins for WebSphere Application Server and Liberty 8.5/9.0.
    • Immediate Action: Patch and review reverse-proxy chains.
    • Mitigation: Install IBM’s update.
  • CVE-2026-48133: Security Gateway internal file read
    • Impact: Unauthenticated users may read internal files.
    • Affected Systems: Security Gateway with Identity Awareness and Browser-Based Authentication.
    • Immediate Action: Restrict access to the portal immediately.
    • Mitigation: Apply the vendor fix.
  • CVE-2026-45728: Algernon single-file mode source disclosure
    • Impact: Requests can leak full server-side source and file contents.
    • Affected Systems: Algernon prior to 1.17.7.
    • Immediate Action: Patch and remove sensitive scripts from served paths.
    • Mitigation: Upgrade to 1.17.7.
  • CVE-2026-44847: MaxKB unauthenticated webhook trigger access
    • Impact: Attackers can invoke triggers and run bound tasks.
    • Affected Systems: MaxKB prior to 2.9.0.
    • Immediate Action: Disable exposed webhook endpoints until updated.
    • Mitigation: Upgrade to 2.9.0.
  • CVE-2025-11482: PPT30 OPC-UA resource exhaustion
    • Impact: Unauthenticated attackers can deny service to legitimate users.
    • Affected Systems: PPT30 Operating System versions before 1.8.0.
    • Immediate Action: Isolate OPC-UA services and patch.
    • Mitigation: Upgrade to 1.8.0 or later.
  • CVE-2026-43988: Vanetza ASN.1/OER parsing crash
    • Impact: Malformed packets can terminate the process.
    • Affected Systems: Vanetza 26.02 and earlier.
    • Immediate Action: Update V2X parsing components immediately.
    • Mitigation: Apply the fixed commit or release.
  • CVE-2026-48048: XWiki password hash discovery flaw
    • Impact: Attackers can recover password salts and hashes bit by bit.
    • Affected Systems: XWiki live table UI components before patched releases.
    • Immediate Action: Patch and force credential review for exposed users.
    • Mitigation: Upgrade to 18.0.0RC1, 17.10.13, 17.4.9, or 16.10.17.
  • CVE-2026-9170: IBM Web Server Plug-ins DoS/RCE risk
    • Impact: Denial of service and possible remote code execution.
    • Affected Systems: IBM Web Server Plug-ins for WebSphere Application Server and Liberty 8.5/9.0.
    • Immediate Action: Patch now and verify front-end exposure.
    • Mitigation: Apply IBM’s fixed release.
  • CVE-2026-45575: epa4all-client forged discovery document attack
    • Impact: Attackers can capture signed authentication material.
    • Affected Systems: epa4all-client prior to 1.2.2.
    • Immediate Action: Treat TI network paths as hostile until updated.
    • Mitigation: Upgrade to 1.2.2.
  • CVE-2026-9551: Das Parking Management System SQL injection
    • Impact: Remote attackers can inject SQL via export functions.
    • Affected Systems: Das Parking Management System 6.2.0.
    • Immediate Action: Restrict access to API endpoints and patch.
    • Mitigation: Apply vendor remediation and review database logs.
  • CVE-2026-9552: Das Parking Management System search SQL injection
    • Impact: Database compromise through remote SQL injection.
    • Affected Systems: Das Parking Management System 6.2.0.
    • Immediate Action: Block public access and update immediately.
    • Mitigation: Apply the vendor fix.
  • CVE-2026-9550: Acrel EEMS path traversal
    • Impact: Remote path traversal may expose or overwrite files.
    • Affected Systems: Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0.
    • Immediate Action: Restrict access to upload endpoints and patch.
    • Mitigation: Apply vendor remediation.
  • CVE-2026-9584: code-projects Project Management System SQL injection
    • Impact: Remote database compromise through login handling.
    • Affected Systems: Project Management System 1.0.
    • Immediate Action: Take the login page off the public internet if possible.
    • Mitigation: Apply vendor or community fixes.
  • CVE-2026-9544: Sixun Shanghui Group Business Management System SQL injection
    • Impact: Attackers can inject SQL remotely.
    • Affected Systems: Sixun Shanghui Group Business Management System 10.
    • Immediate Action: Patch and monitor database access.
    • Mitigation: Apply the vendor fix.
  • CVE-2026-9574: Student Transcript Processing System SQL injection
    • Impact: Remote SQL injection may lead to data theft or code execution.
    • Affected Systems: Student Transcript Processing System 1.0.
    • Immediate Action: Remove public exposure and patch.
    • Mitigation: Apply available fixes.
  • CVE-2026-9575: Student Transcript Processing System class view SQL injection
    • Impact: Remote database compromise.
    • Affected Systems: Student Transcript Processing System 1.0.
    • Immediate Action: Patch immediately.
    • Mitigation: Apply the vendor fix.
  • CVE-2026-9573: Student Transcript Processing System student view SQL injection
    • Impact: Remote SQL injection enables data theft or tampering.
    • Affected Systems: Student Transcript Processing System 1.0.
    • Immediate Action: Restrict access and patch.
    • Mitigation: Apply available updates.
  • CVE-2026-44730: OpenCTI organization admin privilege escalation
    • Impact: Org admins can elevate privileges across organizations.
    • Affected Systems: OpenCTI prior to 6.9.7.
    • Immediate Action: Review org admin assignments and patch.
    • Mitigation: Upgrade to 6.9.7.
  • CVE-2026-42785: OpenKM scripting endpoint RCE
    • Impact: Admins can execute arbitrary Java/BeanShell code.
    • Affected Systems: OpenKM 6.3.12.
    • Immediate Action: Restrict admin access and patch immediately.
    • Mitigation: Apply vendor updates and audit scripting use.
  • CVE-2026-42425: OpenKM unrestricted SQL execution
    • Impact: Admin users can run arbitrary SQL against the database.
    • Affected Systems: OpenKM 6.3.12.
    • Immediate Action: Limit admin access and review database activity.
    • Mitigation: Patch and rotate sensitive credentials if abuse is suspected.
  • CVE-2026-4051: IBM ELM exposed method RCE
    • Impact: Admin-privileged attackers can execute remote code.
    • Affected Systems: IBM ELM 7.0.3 through IF021, 7.1.0 through IF009, 7.2.0 through IF001.
    • Immediate Action: Update and review admin access immediately.
    • Mitigation: Apply the latest fixed interim fix.
  • CVE-2026-24195: NVIDIA Linux UVM input validation flaw
    • Impact: Denial of service.
    • Affected Systems: NVIDIA Display Driver for Linux.
    • Immediate Action: Patch Linux GPU systems.
    • Mitigation: Install the fixed driver.
  • CVE-2026-42012: gnutls certificate validation flaw
    • Impact: Attackers may spoof legitimate services or intercept traffic.
    • Affected Systems: gnutls.
    • Immediate Action: Update libraries used for TLS validation.
    • Mitigation: Apply the patched gnutls release.
  • CVE-2026-3603: IBM ELM XXE
    • Impact: Sensitive data exposure and memory consumption attacks.
    • Affected Systems: IBM ELM 7.0.3 IF001-IF021, 7.1.0 IF001-IF009, and 7.2.0/IF001.
    • Immediate Action: Patch and restrict XML ingestion paths.
    • Mitigation: Apply IBM’s fixed releases.
  • CVE-2025-14361: Woocommerce Envato Affiliates authorization flaw
    • Impact: Attackers can access functionality beyond ACLs.
    • Affected Systems: Woocommerce Envato Affiliates through 1.2.1.
    • Immediate Action: Update the plugin and review access controls.
    • Mitigation: Install the vendor fix.
  • CVE-2026-24196: NVIDIA Linux out-of-bounds read
    • Impact: Denial of service and information disclosure.
    • Affected Systems: NVIDIA Display Driver for Linux.
    • Immediate Action: Patch all Linux hosts using NVIDIA graphics.
    • Mitigation: Apply the fixed driver package.

Previously Alerted

What to Do Now

  1. Patch the highest-risk internet-facing systems first: Twenty CRM, IBM Web Server Plug-ins, Algernon, Dozzle, MaxKB, Chatwoot, OpenKM, FACTION, and any exposed NVIDIA driver endpoints.
  2. Disable or isolate remote management features: VNC on BioFlo 320, SMB/file-serving paths, webhook test endpoints, and admin scripting interfaces.
  3. Review for active abuse: Look for unexpected admin accounts, new template changes, unusual SQL errors, outbound callbacks, and unknown theme or extension imports.
  4. Verify version status: Confirm each affected product is on a fixed release or interim fix, not just “patched recently.”
  5. Assume exposure if public: If a vulnerable service was internet-facing, treat it as high risk until logs and configuration are reviewed.

Verification steps: Check package versions, firmware builds, and interim fix levels against vendor advisories. Confirm that authentication is enforced on webhook, API, and admin endpoints. Search logs for suspicious POSTs, crafted file uploads, SQL injection patterns, and unexpected outbound requests.

Monitoring recommendations: Increase alerts for privilege changes, new admin sessions, web shell indicators, database schema changes, and unusual file imports. Pay special attention to CRM, industrial control, collaboration, and remote-access systems.

Related Resources

  • Internal: A follow-up analysis on prioritizing critical patching for exposed business apps will be published soon.
  • Official vendor advisories: Review IBM, NVIDIA, Magento/Mirasvit, Twenty, FACTION, Algernon, Dozzle, Chatwoot, OpenKM, Snipe-IT, and Eppendorf advisories for fixed versions and deployment guidance.

Keep reading