CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

EUVD-2026-66862

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989 Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton echoes it unescaped, leading to an reflected XSS vector...

CVE-2026-77989

This is a reflected XSS in the Joomla Events Manager extension prior to version 5.0.1 . The root cause lies in the buildCurrentPdfLink function, which copies the current request query string into the PDF button URL, and pdfbutton() echoes it without escaping, creating a reflected XSS vector via t...

Ivanti EPM Cloud Services Appliance Code Injection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. id: CVE-2021-44529 info: name: Ivanti EPM Cloud Services Appliance Code Injection...

CVE-2026-37070

Veno File Manager 4.4.9 contains an incorrect access control flaw in /vfm-admin/ajax/streamvid.php. An authenticated attacker who knows the path and filename of a file uploaded by another user can read it via a specially crafted GET request to the affected endpoint. The CVSS 3.1 score is 6.5 (Med...

CVE-2026-37065

Veno File Manager Project 4.4.9 is affected by an Arbitrary File Deletion vulnerability in the /vfm-admin/index.php endpoint (section=translations&action=update). An authenticated attacker with the superadmin role can send a specially crafted POST request using the remove URL parameter to delete ...

CVE-2026-37069

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

PT-2026-82769

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

CVE-2026-37072

Veno File Manager Project 4.4.9 is vulnerable to an Incorrect Access Control flaw in admin-head-updates.php, specifically a Local File Inclusion via the lang GET parameter. An unauthenticated attacker can send a specially crafted POST request to corrupt the configuration file, then hit the setup ...

CVE-2026-37068

Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write via the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user with the super administrator role can overwrite any PHP file in the application using a specially crafted POST request, potentia...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37073

Veno File Manager Project 4.4.9 suffers from an incorrect access control vulnerability in the /vfm-admin/ajax/sendfiles.php endpoint. An unauthenticated attacker can send emails through the application's configured SMTP server by issuing a POST request with the required parameters and headers. Th...

CVE-2026-37071

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37064

Veno File Manager Project 4.4.9 is affected by a user enumeration vulnerability in the /vfm-admin/ajax/usr-check.php endpoint. An unauthenticated attacker can send a specially crafted POST request with a chosen user_name parameter to determine whether a given user exists in the application, resul...

CVE-2026-37066

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...