🚨 CVE-2026-60027
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
🎖@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
🎖@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with ‘Quix’ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
🚨 CVE-2026-60028
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.
🎖@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG.
🎖@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with ‘Quix’ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
🚨 CVE-2026-60029
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users.
🎖@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users.
🎖@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with ‘Quix’ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
🚨 CVE-2026-60030
The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.
🎖@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions.
🎖@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with ‘Quix’ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
🚨 CVE-2026-60031
The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.
🎖@cveNotify
The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.
🎖@cveNotify
ThemeXpert
Best and Powerful SEO Focused Joomla 4 Drag & Drop Page Builder - ThemeXpert
Create stunning websites with ‘Quix’ the best SEO-focused Joomla 4 drag and drop page builder. No coding required. Start building your website now!
🚨 CVE-2026-60032
The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
🎖@cveNotify
The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
🎖@cveNotify
ThemeXpert
JMedia - Joomla Media Manager
JMedia is the most powerful drag and drop pagebuilder. Powerful Unsplash integration and remote file upload.
🚨 CVE-2026-60033
The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.
🎖@cveNotify
The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.
🎖@cveNotify
ThemeXpert
JMedia - Joomla Media Manager
JMedia is the most powerful drag and drop pagebuilder. Powerful Unsplash integration and remote file upload.
🚨 CVE-2026-60034
The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.
🎖@cveNotify
The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.
🎖@cveNotify
ThemeXpert
JMedia - Joomla Media Manager
JMedia is the most powerful drag and drop pagebuilder. Powerful Unsplash integration and remote file upload.
🚨 CVE-2026-61424
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
🎖@cveNotify
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
🎖@cveNotify
🚨 CVE-2026-61425
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
🎖@cveNotify
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
🎖@cveNotify
mySites.guru
Gridbox Critical Auth Bypass | mySites.guru
A critical unauthenticated authentication bypass in Gridbox for Joomla let anyone become a Super User by setting a single cookie. Fixed in 2.20.1. Update now.
🚨 CVE-2026-61900
The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.
🎖@cveNotify
The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.
🎖@cveNotify
mySites.guru
jDownloads 4.1.6 Fixes Upload Flaw | mySites.guru
jDownloads 4.1.0 to 4.1.5 shipped a leftover test script that let anyone upload files to your Joomla site with no login. Update to 4.1.6, which removes it.
🚨 CVE-2026-62414
The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.
🎖@cveNotify
The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.
🎖@cveNotify
JoomlaCK - Extensions et tutoriels Joomla!
Extensions et documentations Joomlack
Téléchargez des extensions pour joomla, modules, plugins, ou composant. Vous pouvez également télécharger des tutoriels et livres pour créer votre template Joom
🚨 CVE-2026-63107
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
🎖@cveNotify
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.
🎖@cveNotify
GitHub
oss/limesurvey.md at main · geo-chen/oss
securing oss responsibly. Contribute to geo-chen/oss development by creating an account on GitHub.
🚨 CVE-2026-63108
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.
🎖@cveNotify
Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter expansions with opaque placeholders before extracting command substitutions, causing the containsDangerousSubstitution guard to miss nested payloads, which are then auto-approved based on the outer allowlisted command prefix and executed by the shell via execa, enabling arbitrary command execution.
🎖@cveNotify
GitHub
oss/Roo-Code.md at main · geo-chen/oss
securing oss responsibly. Contribute to geo-chen/oss development by creating an account on GitHub.
🚨 CVE-2026-63730
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
🎖@cveNotify
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.
🎖@cveNotify
GitHub
fix(security): block private IPs in webhook SSRF guard; redact ClickH… · hyperdxio/hyperdx@1705b37
…ouse proxy error body (#2593)
Addresses the two findings from hyperdxio/hyperdx#2588 (originally reported via GHSA-fgcx-qxjr-wx26 on 1 June 2026, no response after 30 days).
## Finding A — Webho...
Addresses the two findings from hyperdxio/hyperdx#2588 (originally reported via GHSA-fgcx-qxjr-wx26 on 1 June 2026, no response after 30 days).
## Finding A — Webho...
🚨 CVE-2026-63731
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.
🎖@cveNotify
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist enforcement. Attackers can exploit the reflected error responses from the endpoint to disclose internal service response bodies, enabling access to internal APIs, container services, and cloud provider metadata endpoints.
🎖@cveNotify
GitHub
fix(security): block private IPs in webhook SSRF guard; redact ClickH… · hyperdxio/hyperdx@1705b37
…ouse proxy error body (#2593)
Addresses the two findings from hyperdxio/hyperdx#2588 (originally reported via GHSA-fgcx-qxjr-wx26 on 1 June 2026, no response after 30 days).
## Finding A — Webho...
Addresses the two findings from hyperdxio/hyperdx#2588 (originally reported via GHSA-fgcx-qxjr-wx26 on 1 June 2026, no response after 30 days).
## Finding A — Webho...
🚨 CVE-2026-63768
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
🎖@cveNotify
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
🎖@cveNotify
GitHub
Open Redirect via Unsigned Conferencing OAuth Callback State · Issue #29679 · calcom/cal.diy
reported on 18 May 2026 privately - did not get any responses: https://github.com/calcom/cal.diy/security/advisories/GHSA-xhhm-qx6c-v2mh Summary The conferencing OAuth callback endpoint is unauthen...
🚨 CVE-2026-63769
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
🎖@cveNotify
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
🎖@cveNotify
GitHub
SSRF via Scenario Import URL · Issue #3679 · huginn/huginn
reported privately on 22 May 2026 - no responses since: https://github.com/huginn/huginn/security/advisories/GHSA-pfgh-8rpp-c32m Summary An authenticated Huginn user can cause the server to issue a...
🚨 CVE-2026-63770
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
🎖@cveNotify
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
🎖@cveNotify
GitHub
Authentication Rate Limit Bypass via X-Forwarded-For Spoofing · Issue #1031 · glanceapp/glance
Description reported privately on 22 May 2026 - no response since: https://github.com/glanceapp/glance/security/advisories/GHSA-427g-2pm7-r356 Summary When the proxied server option is set to true ...
🚨 CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
🎖@cveNotify
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
🎖@cveNotify