CVE-2026-63683

The CVE-2026-63683 issue affects the Joomla Extension from Regular Labs (Conditions Manager). It describes a vulnerability where IP and GeoIP conditions trust spoofable forwarded headers, enabling remote clients to bypass location-based rules. The described impact is primarily on integrity (high)...

CVE-2026-64798

Summary: CVE-2026-64798 affects the Joomla Extension from regularlabs.com, specifically the IP login extension. The root cause is the use of a non-cryptographic random generator with insufficient entropy to generate persistent URL login keys. Impact: high confidentiality and integrity risk for lo...

CVE-2026-64795

CVE-2026-64795 concerns Joomla extensions by Regular Labs. The issue is: XSS through tag-provided inputs (custom HTML, module/content/title overrides, and decoded modal/tooltip values) that could allow a content author to inject JavaScript executed in visitors’ browsers. Affected products are Reg...

CVE-2026-64792

CVE-2026-64792 affects Joomla extensions from Regular Labs (Smart Search indexing). The underlying issue is that generated content can be rendered in the search index using the indexing administrator’s identity rather than a public guest, causing restricted or administrator-only content to be sto...

CVE-2026-63281

CVE-2026-63281 concerns a stored XSS in the Joomla extension from Regular Labs (conditions manager). The vulnerability allows stored condition values to render HTML/JavaScript in administrator summaries, enabling possible script execution within admin interfaces. Documented impact is limited to X...

CVE-2026-64791

Summary: CVE-2026-64791 affects Joomla Extensions by Regular Labs (Regular Labs Extension Manager). The issue is Inconsistent CSRF token checks and privilege checks on administrator routes and during install/update/uninstall processing, potentially letting an unauthorized backend user or CSRF att...

CVE-2026-63684

CVE-2026-63684 concerns Joomla extensions from Regular Labs (regularlabs.com). The described vulnerability stems from inconsistent CSRF token checks and privilege checks across multiple admin/import/export actions, including administrator actions and editor popups. This weakness could allow unaut...

CVE-2026-13089

OIDC::Lite for Perl up to 0.12.1 is vulnerable to ID Token signature verification bypass via an unpinned algorithm allowlist. If the caller does not pin the alg, verify uses the token header alg and passes it to decode_jwt with an allowlist from the untrusted token, allowing tokens with alg: none...

CVE-2026-16540

Technical details for CVE-2026-16540 are not publicly available in the provided documents. This reserved candidate has no disclosed affected products, impact, or remediation. Monitor for updates as new information is released.

CVE-2026-64829

CVE-2026-64829 affects Question2Answer up to version 1.8.8. The issue is a session invalidation bug in the forgot-password flow: the handler qa_finish_reset_user() does not clear the sessioncode, allowing a previously issued remember-me cookie to continue authenticating the account after a passwo...

CVE-2026-14881

CVE-2026-14881 affects MongoDB Compass: during imports of connections, an attacker can override connection options that are not normally changeable via the connection form. Specifically, a custom browser open command for the OIDC authentication flow can be injected, which is typically configured ...

CVE-2026-13055

The CVE concerns MongoDB Server (mongod) where the query expression $_internalIndexKey in an aggregation pipeline can crash the server. The root cause is improper handling of compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The vulne...

CVE-2026-13056

CVE-2026-13056 affects MongoDB server where using expressions that generate large arrays can craft a query that creates very large intermediate objects in memory, leading to an out-of-memory crash. The issue arises from producing oversized intermediate data structures during query execution, resu...

CVE-2026-13057

CVE-2026-13057 affects the server’s Atlas Search integration (MongoDB) in sharded topologies. An authenticated client can bypass per-user access controls by supplying internal routing fields for the $search and $searchMeta aggregation stages, which are normally populated only by the trusted route...

CVE-2026-13058

This CVE affects MongoDB’s mongod process. An authenticated user with basic write privileges can send a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, which can trigger a fatal inte...

CVE-2026-13059

Technical details are not publicly available in the provided documents. No specific affected products, versions, or exploit vectors are stated here. Monitor for updates as new information may emerge.

CVE-2026-9737

CVE-2026-9737 concerns MongoDB during query planning when reading a sort pattern in raw BSONObj form. In some cases, the code does not explicitly handle the meta expression, which may cause incorrect transformations and lead to an invariant failure (potential crash). The issue is reflected in the...

CVE-2026-13060

Technical details are not publicly available in the provided documents. The supplied materials do not specify affected products/components, root cause, or remediation. Monitor for updates.

CVE-2026-14899

The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...

CVE-2026-13061

CVE-2026-13061 affects MongoDB: an authenticated user may access session metadata of other users via the $listSessions aggregation stage. Impacted data includes active session IDs, usernames, and activity timestamps, indicating an access-control weakness that ordinarily requires cluster‑level adm...