CVE-2026-66916: Improper Access Control

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-59256: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery...

PT-2026-79526

Name of the Vulnerable Software and Affected Versions JoomGallery versions prior to 4.3.1 Description An unauthenticated access control bypass exists in the category JSON view. While the HTML view correctly enforces password protection for gallery categories, the JSON view fails to perform this...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

CVE-2026-18409: Improper Neutralization of Input During Web Page Generation

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-59989: Improper Control of Generation of Code

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-43679: Improper Access Control

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

GHSA-VGXM-H9GX-H9W7 django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

EUVD-2026-63567

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026

Convert Forms (by tassos.gr) for Joomla , versions below 5.2.5 , is affected by a client-controlled validation bypass. The front-end Submissions view did not enforce access control, allowing an unauthenticated visitor to list a form's submissions. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a ...

EUVD-2026-63242

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

EUVD-2026-63215

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

PT-2026-78921

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...