23278 matches found
CVE-2026-48943
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
CVE-2026-9184
creationtimestamp| type| source ---|---|--- 2026-06-25 16:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4tbneuuh2p...
CVE-2026-2815
creationtimestamp| type| source ---|---|--- 2026-06-25 15:56:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4s6q6fxv2s...
CVE-2026-54843
creationtimestamp| type| source ---|---|--- 2026-06-25 15:41:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4rdtpb6j2j...
CVE-2026-54849
creationtimestamp| type| source ---|---|--- 2026-06-25 15:30:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4qpi25kb2l...
CVE-2026-48943
Summary: CVE-2026-48943 affects K2 ≤ 2.24, specifically the K2 system user plugin plg_user_k2. A mass‑assignment defect allows a registered Joomla user to set the field K2UserForm=1 in a normal com_users profile.save POST and write arbitrary values into the notes, image, and plugins columns of th...
CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
EUVD-2026-39438
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
CVE-2026-48943
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
CVE-2026-48943 Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
CVE-2026-48943
K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin plguserk2. A Registered Joomla user, by including the field K2UserForm=1 in a standard comusers profile.save POST, can write arbitrary values into the notes, image, and plugins columns of their own row in the k2users table —...
CVE-2026-54823
creationtimestamp| type| source ---|---|--- 2026-06-25 15:17:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4pyox3mc2j 2026-06-29 05:16:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpfqbb6hll22...
CVE-2026-56053
creationtimestamp| type| source ---|---|--- 2026-06-25 15:15:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4pv42j7s2j 2026-07-07 05:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpztyiy63o24...
CVE-2026-47154
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observe...
CVE-2026-40209
creationtimestamp| type| source ---|---|--- 2026-06-25 13:56:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4lhwakny2f...
CVE-2026-42005
creationtimestamp| type| source ---|---|--- 2026-06-25 13:55:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4lg4nvzg2o 2026-06-26 11:39:38+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mp6uc6gqtp26 2026-06-30 07:00:37+00:00| seen|...
CVE-2020-7610
creationtimestamp| type| source ---|---|--- 2026-06-25 10:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp46nrvwb42h...
CVE-2026-12937
creationtimestamp| type| source ---|---|--- 2026-06-25 09:04:06+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp4354jpuf2f 2026-06-25 22:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp5hfefa3x2l...
CVE-2026-12245
creationtimestamp| type| source ---|---|--- 2026-06-25 07:55:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3xbltijl2w 2026-07-10 01:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqaz5nfcwr23 2026-07-26 02:01:30+00:00| seen|...