CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...

WordPress security-ninja-premium plugin < 5.290 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Adam Clinch in WordPress Plugin security-ninja-premium versions 5.290...

PT-2026-65806

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

PT-2026-65792

Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65881

CVE-2026-65881 affects the Joomla extension for Joomdle (versions older than 3.1.1). The issue arises from an insecure default configuration that allowed read access and password reset of CMS accounts, effectively enabling read/write access to user accounts via the extension’s default setup. The ...

CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

CVE-2026-65879 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

Microsoft Edge (Chromium) < 150.0.4078.99 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 150.0.4078.99. It is, therefore, affected by multiple vulnerabilities as referenced in the July 25, 2026 advisory. - Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...

CVE-2026-55717 affecting package unbound for versions less than 1.25.2-1

CVE-2026-55717 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55973 affecting package unbound for versions less than 1.25.2-1

CVE-2026-55973 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55708 affecting package unbound for versions less than 1.25.2-1

CVE-2026-55708 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-50045 affecting package unbound for versions less than 1.25.2-1

CVE-2026-50045 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1

CVE-2026-50252 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55991 affecting package unbound for versions less than 1.25.2-1

CVE-2026-55991 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-54478 affecting package unbound for versions less than 1.25.2-1

CVE-2026-54478 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-44687 affecting package unbound for versions less than 1.25.2-1

CVE-2026-44687 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65452

CVE-2026-65452 affects the WordPress Ebook Store plugin up to version 6.19, with an Unauthenticated Broken Access Control vulnerability. The description in both records confirms unauthenticated access issues that impact access control, but no technical exploit steps, root cause specifics, or reme...