CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Joomla Balbooa Forms Extension Unauthenticated Remote Code Execution Vulnerability (CVE-2026-56291)
[Affected Scope] Joomla Balbooa Forms extension versions prior to 2.4.1
[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full Remote Code Execution (RCE) and complete compromise of the web server
[Mitigation] Immediately upgrade the Balbooa Forms extension to version 2.4.1 or higher, and disable script execution in upload directories
Joomla Page Builder CK Extension Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-56290)
[Affected Scope] Joomla Page Builder CK extension versions prior to 3.6.0
[Impact] Unauthenticated attackers can upload arbitrary executable files (such as PHP), leading to full remote code execution (RCE) and complete compromise of the web server
[Mitigation] Immediately upgrade the Page Builder CK extension to version 3.6.0 or higher
SmarterMail Unauthenticated Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2025-52691) Critical Security Advisory
[Affected Scope] SmarterMail mail server software
[Impact] Unauthenticated remote attackers can upload arbitrary files to any location on the mail server, potentially leading to full Remote Code Execution (RCE)
[Mitigation] Immediately apply the latest official security patches and restrict external access to sensitive upload endpoints and admin interfaces
NUUO NVRmini2 Unauthenticated User Creation and Remote Code Execution (CVE-2022-23227)
[Affected Scope] NUUO NVRmini2 firmware versions up to and including 3.11.
[Impact] Unauthenticated attackers can add arbitrary users and, when chained with CVE-2011-5325, overwrite files under the web root to execute arbitrary code as root.
[Mitigation] Immediately restrict external access to the device, apply the latest firmware updates, or implement strict access control lists.