CVE-2026-60033

Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

EUVD-2026-46055

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

CVE-2026-60033

Affected product: Joomla extension JMedia (versions

CVE-2026-60033 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

CVE-2026-60033 Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0

Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

CVE-2026-60032 Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0

Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-60028 Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page...

CVE-2026-60028

The CVE-2026-60028 entry concerns the Joomla extension Quix Page Builder Pro, vulnerable to an authenticated stored XSS due to unescaped output and unsanitised SVG. The issue affects Quix Page Builder Pro (prior to version 6.2.1) where an authenticated builder user can inject scripts that execute...

CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

CVE-2026-45139

Summary of CVE-2026-45139 (CI4MS Fileeditor) : The Fileeditor module fails to validate the source path extension for two destructive endpoints, deleteFileOrFolder and renameFile, allowing a backend user with file-editor permissions to delete or rename arbitrary files inside the project root (e.g....

CVE-2026-45139 CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...

USN-8565-1: SQLite vulnerabilities

It was discovered that SQLite did not properly handle NULL pointer dereferences in the Session Extension when applying a corrupt changeset. An attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service. CVE-2026-50812 It was discovered that SQLite had a buff...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-52656

CVE-2026-52656 affects SJCAM AllWinner Tech SJ4000-Air prior to v1.4C and Whitelabel-based prior to v1.4C. The issue allows an attacker to execute arbitrary code via a specially crafted FEX file. Connected sources confirm affected versions and vulnerability class; PT-2026-61058 notes no public fi...

PT-2026-61703

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restricted extensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST...

Oracle Linux 9 : php:8.2 (ELSA-2026-40416)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory. php 8.2.32-1 - rebase to 8.2.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 -...

PT-2026-61695

Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.56 Description Remote execution injection is possible via EDNS EXTENDED ERROR. The function decompose in Net::DNS::RR::OPT::EXTENDED ERROR parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option by tokenizing...

Linux Distros Unpatched Vulnerability : CVE-2026-63920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy...

CVE-2026-64130

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix initialization of tags of the huge zero folio with initonfree GFPZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside GFPZERO and GFPSKIPKASAN. If we run with...

CVE-2026-63920

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...