ScanForge Security Digest 2636-02

September 4, 2026200 items

30 critical29 high10 news

This week's security digest includes 0 actively exploited vulnerabilities (CISA KEV), 30 critical CVEs, and 29 high-severity CVEs. Review the details below and prioritize patching for any affected systems.

Critical

10.0 A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker CVE-2026-33591

10.0 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authentic CVE-2026-49869

10.0 A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also r CVE-2023-7309

10.0 The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is als CVE-2024-42450

9.9 A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod CVE-2026-15630

9.8 In the Linux kernel, the following vulnerability 12 CVEs

CVE-2026-64069, CVE-2026-64068, CVE-2026-64067, CVE-2026-64066, CVE-2026-64061 +7 more

9.8 Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 thr CVE-2026-33937

9.8 The Versa Director software exposes a number of services by default and allow attackers an easy foot CVE-2025-24288

9.4 OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree c CVE-2026-39932

9.3 A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos CVE-2026-18367

9.3 Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vul CVE-2026-25550

9.2 CommServe 2 CVEs

CVE-2026-13738, CVE-2026-13737

High Severity

8.9 A user holding a permission to update privilege definitions could modify a wildc CVE-2026-17601

8.8 Missing authorization in Visual Studio Code allows an unauthorized attacker to e CVE-2026-59113

8.8 A legacy endpoint in Command Center contained an unauthenticated server-side req CVE-2026-13739

8.8 Rancher issues long-lived registration tokens to authenticate nodes and agents j CVE-2026-55997

8.8 Privilege escalation in the DOM: Navigation component. This vulnerability was fi CVE-2026-16371

8.8 Privilege escalation in the DOM: Workers component. This vulnerability was fixed CVE-2026-16365

8.8 In the Linux kernel, the following vulnerability 2 CVEs CVE-2026-53275, CVE-2026-43112

8.8 A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM0 CVE-2022-34821

8.7 Missing Authorization in the permission management component in Roskus Prospero CVE-2026-59233

8.7 Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool CVE-2026-17603

+15 more products affected

Security News

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws The Hacker News

Plex is urging users to update their instances to the latest version following the release of an update that patches mul

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day The Hacker News

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active explo

GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests The Hacker News

OpenAI on Thursday officially unveiled GPT‑6 Astra, which it described as the "world's most intelligent and aligned mode

French hospital fined €500,000 after breach exposes data of 727,000 Bleeping Computer

France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequat

Large Enterprises Targeted in Fake Merger & Acquisition Scams Dark Reading

Threat actors behind the "Phantom Deal" campaign are studying companies in extreme detail, aiming to dupe midlevel emplo

Coder's registry infrastructure compromised to push malicious modules Bleeping Computer

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious

What We Missed: Did ShinyHunters 'Breach' ReliaQuest? Dark Reading

In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the la

HPE patches critical ArubaOS-CX remote code execution flaw Bleeping Computer

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that co

Exploits & Threats

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

[dos] EVerest 2025.9.0 - DoS

[webapps] PodcastGenerator 3.2.9 - Stored XSS