CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)
[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0
[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full remote code execution (RCE) and complete compromise of the web server
[Mitigation] Immediately upgrade the Page Builder CK extension to version 3.6.0 or higher
Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)
[Affected Scope] Joomla iCagenda extension versions prior to 3.9.15 and 4.0.8
[Impact] Unauthenticated remote attackers can bypass file upload restrictions to upload malicious PHP scripts, leading to complete system compromise via Remote Code Execution (RCE).
[Mitigation] Immediately upgrade the iCagenda extension to the patched versions (3.9.15 / 4.0.8 or higher) and disable script execution in upload directories.
Joomla JCE Editor Extension Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-48907)
[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS
[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)
[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests