CVE-2026-48948

Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48953

Joomla! Core - [20260707] - XSS in the generic image output layout

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48951

Joomla! Core - [20260705] - XSS in various modalreturn layouts

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48957

Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints

An improper access check allows unauthorized users to access com_privacy datasets.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48956

Joomla! Core - [20260710] - Incorrect Access Control in com_modules

An improper access check allows users to display a list of modules in the frontend.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48955

Joomla! Core - [20260709] - Incorrect Access Control in com_workflow

An improper access check allows unauthorized users to access workflow stage and transition information.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48950

Joomla! Core - [20260704] - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48958

Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48947

Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints

An improper access check allows privileged users to overwrite media files without editing permissions.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-48952

Joomla! Core - [20260706] - XSS in com_installer

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-44877

Unauthenticated Remote Disclosure of Cryptographic Secrets

An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of this vulnerability could allow an unauthenticated remote threat actor to access sensitive cryptographic secrets on a vulnerable system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Networking Instant On

CVE-2026-55417

Chevereto private profile setting leaks username on /json endpoint

Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiting their profile HTML route (`/username`) correctly returns 404. However, the `/json` AJAX listing endpoint does not apply the same check. An unauthenticated caller who knows the target's user ID can retrieve all of that user's publicly-scoped images, revealing the username (which should be private). This is patched in Chevereto v4.5.4. No known workarounds are available.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Chevereto

Products

Chevereto Chevereto-free

CVE-2026-55592

Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Lissy93

Products

Dashy

CVE-2026-49471

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Oraios Oraios-ai

Products

Serena Serena

CVE-2026-55408

Koodo Reader: Remote code execution via malicious epub file

Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user's privileges. This issue is fixed in version 2.3.1.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Koodo-reader

Products

Koodo-reader

CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$. Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bakerscot

Products

String::util

CVE-2026-14244

Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Jssor Wordpress

Products

Jssor Slider By Jssor.com Wordpress

CVE-2026-9842

Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Pixelgrade Wordpress

Products

Backstage – Customizer Demo Access Wordpress

CVE-2026-14482

多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator` and enabling open registration — and subsequently register an account with full administrator privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Shen2 Wordpress

Products

多说社会化评论框 Wordpress

CVE-2026-9701

Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Joe007 Wordpress

Products

Eventer Wordpress