CVE-2026-8593: Missing Authorization

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...

GHSA-4G3V-8H47-V7G6 Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

NPM: Astro: Reflected XSS via unescaped View Transition animation properties

NPM: Astro: Reflected XSS via unescaped View Transition animation properties vulnerability discovered by ? in WordPress Npm astro versions = 2.9.0, = 7.0.9...

CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

aegis-tools (>=0.0.3, <=0.7.2), brew-view (>=2.3.1, <=2.3.10) +3 more potentially affected by CVE-2025-67726 via tornado (4.5.2)

tornado PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - aegis-tools =0.0.3, =2.3.1, =0.1.3, =0.1.7 Source cves: CVE-2025-67726 Source advisory: OSV:GHSA-JHMP-MQWM-3GQ8...

aegis-tools (>=0.0.3, <=0.7.2), brew-view (>=2.3.1, <=2.3.10) +3 more potentially affected by CVE-2025-67725 via tornado (4.5.2)

tornado PYPI version 4.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - aegis-tools =0.0.3, =2.3.1, =0.1.3, =0.1.7 Source cves: CVE-2025-67725 Source advisory: OSV:GHSA-C98P-7WGM-6P64...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2025-67725 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2025-67725 Source advisory: OSV:GHSA-C98P-7WGM-6P64...

CVE-2026-62414 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views...

CVE-2026-60026

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

CVE-2026-60026 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...

EUVD-2026-46058

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got executed via view-cache include. Requires caching on default...

CVE-2026-14448

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-14448

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

EUVD-2026-45901

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-14448 Authenticated RCE in system_certificates view

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-14448 Authenticated RCE in system_certificates view

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-14448

CVE-2026-14448 describes an authenticated remote command-injection vulnerability in the system_certificates view. The root cause is improper neutralization of special elements in an OS command, enabling high-privilege attackers to execute arbitrary commands. Impact per sources includes total loss...

PT-2026-66638

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

PT-2026-61673

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got executed via view-cache include. Requires caching on default...

CVE-2026-60026: Improper Control of Generation of Code

Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user core.create/core.edit could inject PHP tags in element content, that got...