ScanForge Security Digest 2638-02

September 20, 2026200 items

80 critical28 high10 news

This week's security digest includes 0 actively exploited vulnerabilities (CISA KEV), 80 critical CVEs, and 28 high-severity CVEs. Review the details below and prioritize patching for any affected systems.

Critical

10.0 IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute a CVE-2026-10747

10.0 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 CVE-2025-15399

10.0 Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate pri CVE-2026-69843

10.0 Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to e CVE-2026-62874

10.0 Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to CVE-2026-85889

10.0 Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov CVE-2026-83944

10.0 Improper limitation of a pathname to a restricted directory 2 CVEs

CVE-2026-70200, CVE-2026-70009

10.0 Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. CVE-2026-62104

10.0 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-co CVE-2026-75754

10.0 SiYuan 4 CVEs

CVE-2026-66012, CVE-2026-65606, CVE-2026-65605, CVE-2026-66396

10.0 Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowin CVE-2025-71338

9.9 IBM Guardium Data Protection 12.2 4 CVEs

CVE-2026-80442, CVE-2026-82967, CVE-2026-82340, CVE-2026-80441

High Severity

8.9 n8n 2 CVEs CVE-2026-71539, CVE-2026-72772

8.8 IBM Guardium Data Protection 12.2 2 CVEs CVE-2026-84034, CVE-2026-81656

8.8 IBM Guardium Data Protection 12.2 could 2 CVEs CVE-2026-82887, CVE-2026-82885

8.8 IBM MQ could 4 CVEs CVE-2026-11381, CVE-2026-11378, CVE-2026-11375, CVE-2026-10575

8.8 The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Wr CVE-2026-12954

8.8 Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remot CVE-2026-93382

8.8 Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 CVE-2026-93381

8.8 Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote at CVE-2026-93377

8.8 The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N CVE-2026-52483

8.8 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when ex CVE-2026-15815

+11 more products affected

Security News

BragJack attacks hijack AI browser agents through malicious extensions Bleeping Computer

BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Oper

TigerByte Cyber Emerges From Stealth With $3 Million in Funding SecurityWeek

The company has secured over $7 million in contracts with US government agencies, including the US Space Force, the US N

North Korean WaterPlum hackers infected 30,000 devices worldwide Bleeping Computer

A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang Bleeping Computer

The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor sit

Identity Visibility in 2026: The Foundation of Identity Security The Hacker News

Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among t

Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws The Hacker News

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take ove

Viral AI actress' hotline face-scans every caller, watches their mood Bleeping Computer

AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Til

Calling viral AI actress Tilly Norwood? Agree to a face scan first Bleeping Computer

AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Til