⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A critical vulnerability (CVE-2026-48939) in iCagenda, a calendar and event management extension for Joomla, allows attackers to upload arbitrary files, including malicious PHP code, through its file attachment feature. This unrestricted file upload flaw can lead to remote code execution, enabling attackers to take control of affected systems.
Microsoft SharePoint Server: Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
Adobe ColdFusion: Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
JoomShaper SP Page Builder, a popular website builder for Joomla, has a critical vulnerability (CVE-2026-48908) that allows unauthenticated attackers to upload arbitrary files, including malicious PHP code, leading to remote code execution. CISA confirmed the flaw is actively being exploited in the wild and added it to their Known Exploited Vulnerabilities catalog on July 7, 2026.
Balbooa Forms, a popular web form builder, has been identified with a critical vulnerability (CVE-2026-56291) that allows unauthenticated users to upload arbitrary files, including executable files, potentially leading to remote code execution (RCE). This unrestricted upload of dangerous file types poses a severe security risk, as attackers could exploit it to gain full control over affected systems.
Cisco IOS 12.4 contains critical cross-site request forgery (CSRF) vulnerabilities (CVE-2008-4128) that allow remote attackers to execute arbitrary commands. The flaws exist in two specific URIs: "/level/15/exec/-" (via a "show privilege" command) and "/level/15/exec/-/configure/http" (via an "alias exec" command).