ScanForge Security Digest 2638-01

September 17, 2026200 items

74 critical6 high10 news

This week's security digest includes 0 actively exploited vulnerabilities (CISA KEV), 74 critical CVEs, and 6 high-severity CVEs. Review the details below and prioritize patching for any affected systems.

Critical

10.0 The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check CVE-2026-81648

10.0 In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive devi CVE-2026-49883

10.0 In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permissio CVE-2026-28659

10.0 LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi CVE-2026-45618

10.0 Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress < CVE-2026-25470

9.9 ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('E CVE-2026-48273

9.9 privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain CVE-2026-78155

9.8 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attac CVE-2026-87595

9.8 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attac CVE-2026-87544

9.8 An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the CVE-2026-79577

9.8 PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability i CVE-2026-75429

9.8 An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID sessi CVE-2026-75171

High Severity

8.9 Tor before 0.4.9.11 is prone to a race condition where in just the right circums CVE-2026-77638

8.8 Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 CVE-2023-46273

8.8 The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any author CVE-2026-88793

8.8 The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or vali CVE-2026-85129

8.8 The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisatio CVE-2026-74933

8.8 zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters CVE-2026-87795

Security News

Windows 11 KB5124008 update breaks domain trust for some users Bleeping Computer

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets Bleeping Computer

Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK

Malware bypasses browser checks to force install Chrome, Edge extensions Bleeping Computer

A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and

Data Broker Radaris Loses Domains in Privacy Fight Krebs on Security

The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from

Fighting Your Dragons Through Tough Tech Times Dark Reading

Cybersecurity industry veteran Hal Pomeranz gives a pep talk on career anxiety and self-doubt and shares how to build me

Spain's data agency gets first report of AI-powered data breach Bleeping Computer

The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly carried out with an AI agent powered by a

BragJack Attack Can Turn a Browser's Agentic AI Against It Dark Reading

A new type of attack hijacks the AI assistant built directly into various browsers to access sensitive information, exec

First Agentic AI Data Breach Reported to Spanish Regulator SecurityWeek

Spanish regulators say an AI agent chained together a successful login, vulnerability discovery, and access to personal