PT-2026-56221

Name of the Vulnerable Software and Affected Versions Joomla! Core affected versions not specified Description An improper access check in the com contact component allows a user to download vCard exports of contacts that should be inaccessible. Recommendations At the moment, there is no...

CVE-2026-48948: Improper Access Control

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets

Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs. Imperva buried instructions inside shared contacts, vCards, and...

[20260702] - Core - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of comcontact contacts that are inaccessible...

OSV-2026-621 Use-of-uninitialized-value in vcardtime_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903588 Crash type: Use-of-uninitialized-value Crash state: vcardtimefromstring vcardvaluenewfromstring parsevcard...

PT-2026-36942

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=505903588 Crash type: Use-of-uninitialized-value Crash state: vcardtime from string vcardvalue new from string parse vcard...

libical:libicalvcard_fuzzer: Use-of-uninitialized-value in vcardtime_from_string

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6040898940239872 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalvcardfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

OSV-2026-311 UNKNOWN READ in strncasecmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponentstringtokind parsevcard...

PT-2026-23905

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=487216732 Crash type: UNKNOWN READ Crash state: strncasecmp vcardcomponent string to kind parse vcard...

OSV-2026-308 Heap-buffer-overflow in vcardstructured_new_from_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=486715154 Crash type: Heap-buffer-overflow WRITE 8 Crash state: vcardstructurednewfromstring vcardparametersetvaluefromstring parsevcard...

libical:libicalvcard_fuzzer: Crash in strncasecmp

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6010123784093696 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalvcardfuzzer Job Type: libfuzzerubsanlibical Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000002710...

libical:libicalvcard_fuzzer: Heap-buffer-overflow in vcardstructured_new_from_string

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6495267754147840 Project: libical Fuzzing Engine: afl Fuzz Target: libicalvcardfuzzer Job Type: aflasanlibical Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x7cb1f8ee01...

OSV-2026-272 Heap-use-after-free in vcardproperty_get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=485932113 Crash type: Heap-use-after-free READ 8 Crash state: vcardpropertygetvalue vcardpropertygetversion parsevcard...

libical:libicalvcard_fuzzer: Heap-use-after-free in vcardproperty_get_value

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6586677341782016 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalvcardfuzzer Job Type: libfuzzerasanlibical Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

PT-2026-21533

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=481635423 Crash type: Segv on unknown address Crash state: icalarray append icalstrarray append parse vcard...

libical:libicalvcard_fuzzer: Segv on unknown address in icalarray_append

Project: https://github.com/libical/libical.git Detailed Report: https://oss-fuzz.com/testcase?key=6701878934306816 Project: libical Fuzzing Engine: libFuzzer Fuzz Target: libicalvcardfuzzer Job Type: libfuzzermsanlibical Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash...

CVE-2020-37071

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071 CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...

CVE-2020-37071

Summary: CVE-2020-37071 affects CraftCMS 3 vCard Plugin 1.0.0 and is a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code via a crafted payload. The attack is triggered by exploiting the plugin’s vCard download functionality with a specially crafted ...

CVE-2020-37071

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download...