CVE-2026-55219

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/Livewire/Invoices/Show.php executes a pessimistic row lock lockForUpdate outside of an active database transaction. Because MySQL/MariaDB...

CVE-2026-53593

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...

CVE-2026-53593

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...

CVE-2026-53593 FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...

CVE-2026-53593

FreeScout prior to 1.8.224 is vulnerable to authenticated remote code execution due to an incomplete denylist for dangerous upload extensions. The upload endpoint POST /uploads/upload stores files with their original extension in storage/app/public/uploads/ and serves them at /storage/uploads/. O...

CVE-2026-61901

Joomla Extension - hikashop.com - Open redirect in Hikashop 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect...

CVE-2026-60034

Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS...

CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

MGASA-2026-0278 Updated sqlite3 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: SQLite before 3.53.2 Memory Corruption in FTS5 Extension. CVE-2026-11822 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate. CVE-2026-11824...

Updated sqlite3 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: SQLite before 3.53.2 Memory Corruption in FTS5 Extension. CVE-2026-11822 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate. CVE-2026-11824...

CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-61425

CVE-2026-61425 affects the Joomla extension Gridbox (Gridbox

CVE-2026-61424

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61424

CVE-2026-61424 affects the Joomla extension DJ-Classifieds . The connected documents describe an unauthenticated file upload vulnerability that leads to full remote code execution (RCE) . The CVE entry specifies the issue for DJ-Classifieds versions earlier than 3.11.2. This means an attacker cou...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views...

CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6

The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-61900

Affected software: Joomla extension DJ-Extensions JDownloads (DJ-jDownloads). Vulnerability: Unauthenticated file upload leading to full RCE. Root cause / details: Reported as unauthenticated arbitrary file upload in JDownloads prior to a fixed version. The CVEs describe a critical remote code ex...