ScanForge Security Digest 2629-01

July 15, 2026200 items

30 critical51 high10 news

This week's security digest includes 0 actively exploited vulnerabilities (CISA KEV), 30 critical CVEs, and 51 high-severity CVEs. Review the details below and prioritize patching for any affected systems.

Critical

10.0 Unauthenticated remote attackers can access the system through the LoadMaster management interface, CVE-2024-1212

9.9 Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59 CVE-2026-59827

9.8 Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS CVE-2026-44024

9.8 Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potential CVE-2025-10585

9.8 Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code end CVE-2025-3248

9.8 ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote CVE-2024-11680

9.8 BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code CVE-2024-6127

9.8 ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Cor CVE-2024-36265

9.8 An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute ar CVE-2024-23052

9.8 Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthe CVE-2024-23679

9.8 CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnera CVE-2024-22051

9.8 MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipO CVE-2023-45853

High Severity

8.9 A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected CVE-2026-15511

8.9 During bosh create-env and bosh delete-env, the CLI uploads compiled CPI package CVE-2026-47828

8.8 The Joomla extension Helix Ultimate 2 CVEs CVE-2026-57830, CVE-2026-57829

8.8 Crawl4AI 2 CVEs CVE-2026-56260, CVE-2026-56259

8.8 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo CVE-2026-59822

8.8 NATS Server is a high-performance server for NATS.io, the cloud and edge native CVE-2026-58253

8.8 U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readl CVE-2026-29009

8.8 OpenEXR provides the specification and reference implementat 2 CVEs CVE-2026-42216, CVE-2026-41142

8.8 Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote a CVE-2025-13223

8.8 Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution CVE-2024-21529

+35 more products affected

Security News

Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes Dark Reading

Three of the 622 CVEs for which Microsoft issued patches this week are zero-days; there are more than 60 critical vulner

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now Bleeping Computer

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2

Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack The Hacker News

Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already

Spanish Police take down €140 million cyber fraud ring, arrest four Bleeping Computer

The Spanish Police dismantled a cybercrime and money-laundering organization that made €140 million ($160 million) from

6 GHz Wi-Fi Flaws Could Disrupt Critical Systems Dark Reading

Automated Frequency Coordination systems by default trust client-side data, which could lead to location spoofing and ot

Microsoft Patches a Record 570 Security Flaws Krebs on Security

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and

Nearly 300 GitHub repos pose as legit software to push malware Bleeping Computer

A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security project

Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days SecurityWeek

Two flaws in Active Directory and SharePoint Server have been exploited as zero-days, and a BitLocker bug was publicly d