CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873

CVE-2026-64873 affects the Joomla Extension Cache Cleaner Pro from Regular Labs. The issue is described as an SSRF vulnerability where custom query URLs could reach internal or reserved network services, implying a high-severity impact (CVSS: 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base score 9...

CVE-2026-64871

CVE-2026-64871 affects the Joomla extension Cache Cleaner from Regular Labs. The report describes inconsistent CSRF token checks and privilege checks for administrator URL purge actions, meaning those actions did not consistently require a valid token and the necessary cache-management permission...

CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

CVE-2026-65430

CVE-2026-65430 concerns a Joomla extension from regularlabs.com (GeoIP component) where MaxMind credentials were leaked in request URLs. The connected documents provide the vulnerability description but do not specify affected versions, exact vulnerable file(s)/function, or root cause details bey...

CVE-2026-63265

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form...

CVE-2026-64797

CVE-2026-64797 affects the Joomla extension from regularlabs.com (IP Login). The vulnerability arises because the extension trusts forwarded client-IP headers without requiring a configured trusted proxy, allowing an attacker to spoof the IP used for automatic login and potentially impersonate ma...

CVE-2026-63265

CVE-2026-63265 affects the Joomla Regular Labs extension (Regular Labs AJAX endpoints). The issue arises from inconsistent CSRF token validation and privilege checks that don’t consistently align with component/item permissions and trusted server-generated form configuration. As a result, authent...

CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form...

CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...

CVE-2026-63280

The CVE-2026-63280 entry concerns the Joomla extension Regular Labs Conditions Manager. Affected component/function: conditions administration within the extension. Root cause: inconsistent enforcement of tokens (CSRF protection) and of component/mapped-item permissions. This could enable imprope...

CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions...

CVE-2026-63683 Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules...

CVE-2026-63683

The CVE-2026-63683 entry concerns the Joomla extension from Regular Labs (the Regular Labs conditions manager). The description in the connected CVE records states that IP and GeoIP conditions trust spoofable forwarded headers, enabling remote clients to bypass location-based rules. The root caus...

CVE-2026-64798

CVE-2026-64798 affects a Joomla extension by Regular Labs (IP login extension). The issue is that persistent URL login keys are generated using a non-cryptographic random generator with insufficient entropy, which could undermine the security of persistent login tokens. The connected documents co...

CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

CVE-2026-64795

CVE-2026-64795 affects Regular Labs Joomla extensions. The issue arises from tag-provided custom HTML, module content/title overrides, and decoded modal/tooltip values that can render unsafe markup, enabling a content author to inject JavaScript that executes in visitors’ browsers. The sources co...