CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

CVE-2026-76569

Phoca Download extension versions 5.0.0 through 6.1.4 for Joomla contains a reflected XSS flaw in the search GET parameter; attacker-supplied input is reflected unescaped, enabling script execution in a victim's browser. CVSS 4.0 scores it Medium (5.3). No exploitation or patch version is documen...

EUVD-2026-63211

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

CVE-2026-76565

PhocaCart (Joomla extension by phoca.cz) versions 5.0.0–6.1.7 are vulnerable to Reflected XSS (CWE-79) via the price_from and price_to GET parameters. The root cause is that these parameters are processed with Joomla's 'string' input filter, which applies only strip_tags() without htmlspecialchar...

CVE-2026-76565 Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Reflected XSS via pricefrom & priceto filter parameters in Phoca Cart 5.0.0-6.1.7...

PT-2026-78903

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

PT-2026-78921

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

PT-2026-80253

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

PT-2026-78900

Name of the Vulnerable Software and Affected Versions iCagenda versions 4.0.8 through 4.0.12 Description The frontend Submit an Event form allows authenticated users to perform a Stored Cross-Site Scripting XSS attack. This occurs because the image and file fields are stored as raw strings withou...

CVE-2026-76569: Improper Neutralization of Input During Web Page Generation

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

Nmap 7.9.9 Extension Header Integer Underflow

Proof of concept for the IPv6 extension header integer underflow discovered in Nmap version 7.9.9. Exploit Title: Nmap 7.99 - Extension Header Integer Underflow CVE: CVE-2026-58058 Date: 2026-06-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author...

PT-2026-78901

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

PT-2026-80747

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

PT-2026-79374

Name of the Vulnerable Software and Affected Versions PassPortal browser extension versions prior to 3.49.6 Description An unvalidated postMessage vulnerability in the PassPortal browser extension allows for authentication abuse. This flaw enables any website or iframe viewed by a user to obtain...

AlmaLinux 10 : php8.4 (ALSA-2026:56969)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56969 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Arbitrary code execution via out-of-bounds write in bccomp...

PostgreSQL PL/Per Extension Code Execution

The vulnerability of the PL/Per extension interface of the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-52854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser functi...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-14308 Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

privacybadger v2026.8.7

Privacy Badger Privacy Badger is a browser extension that automatically learns to block hidden trackers. Privacy Badger is made by the leading digital rights nonprofit EFF to stop companies from spying on you. Privacy Badger sends the Global Privacy Control signal to opt you out of data sharing a...