{"vulnerability": "CVE-2026-4893", "sightings": [{"uuid": "ef02630f-ca9c-4f8b-804b-119c67c34126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mllwk5mbq72t", "content": "CVE-2026-4893 - CVE-2026-4893\nCVE ID : CVE-2026-4893\n \n Published : May 11, 2026, 6:16 p.m. | 14\u00a0minutes ago\n \n Description : An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet...", "creation_timestamp": "2026-05-11T18:43:43.816870Z"}, {"uuid": "ff933cd8-de46-435c-9a7d-dd2d082e9ae4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mllwk5mbq72t", "content": "CVE-2026-4893 - CVE-2026-4893\nCVE ID : CVE-2026-4893\n \n Published : May 11, 2026, 6:16 p.m. | 14\u00a0minutes ago\n \n Description : An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet...", "creation_timestamp": "2026-05-11T18:43:43.815746Z"}, {"uuid": "e6d27f70-74ea-48ae-a623-62515e70ef35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/bb20f34e-4314-42f2-8e6b-cb2c917339bc", "content": "", "creation_timestamp": "2026-05-13T12:31:36.904766Z"}, {"uuid": "e6c25795-2db0-451a-ba94-a43693293310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "https://t.me/GithubRedTeam/86071", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE20264893poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lottiedeyan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-27 05:56:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGenerate the poc for CVE-2026-4893: broken EDNS Client Subnet validation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-27T06:00:06.000000Z"}, {"uuid": "98065a8b-c24a-4f6a-bd62-edfdedf07000", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "Telegram/XPzjER_VXnqDaL0x3el2A57nJCguhK8qowmsl0HK-KFshHo", "content": "", "creation_timestamp": "2026-05-27T21:09:44.000000Z"}, {"uuid": "15f9b3b6-cf8b-4e07-a9f6-45bd81f76b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4893", "type": "seen", "source": "Telegram/XzC-KGBCdspPXiEjFuhhLQhveWuSfskWTBPYimD-K-OCFrQ", "content": "", "creation_timestamp": "2026-05-27T21:02:29.000000Z"}, {"uuid": "9b4c1ddd-28e2-4aa5-baef-cd94354bd3ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mon66r4i6w2y", "content": "Node.js fixed 13 CVEs across 22.23.0, 24.17.0 and 26.3.1. The two HIGH-rated ones stand out: a WebCrypto AES integer overflow (CVE-2026-48933) that aborts the process, and a TLS authentication bypass (CVE-2026-48618). Is your CI pinned to a patched minor yet?\n\n#nodejs", "creation_timestamp": "2026-06-19T10:48:46.622778Z"}, {"uuid": "b4962dcf-c841-4259-b422-cc05df55e43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48930", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:17.996857Z"}, {"uuid": "77f53a38-cb47-4c15-8096-cf8828db4ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48931", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.158208Z"}, {"uuid": "8c9fd8b6-47b2-4dc5-9ec1-4d5c7bc261f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.313785Z"}, {"uuid": "b7b1b882-e0b2-439a-9c93-991f052a331c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48934", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.448016Z"}, {"uuid": "adb417dc-81eb-44b4-8078-6ddb3f468cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48935", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.597490Z"}, {"uuid": "8b5ff07f-6bc9-41db-8989-fe52d161e294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48936", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.731785Z"}, {"uuid": "da0439b1-3ece-4c46-9e64-a5e9dbf882ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48937", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3moni2fdzi32c", "content": "\ud83d\udd17 CVE : CVE-2026-21636, CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935, CVE-2026-48936, CVE-2026-48937", "creation_timestamp": "2026-06-19T13:45:18.886059Z"}, {"uuid": "ead1cf0c-38c2-4eff-a4e4-60bc0a9e547a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mopyiqfnx42t", "content": "CVE-2026-48939 - Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla\nCVE ID : CVE-2026-48939\n \n Published : June 20, 2026, 11:56 a.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : A vulnerability in the iCagenda extension for Joomla allows the ...", "creation_timestamp": "2026-06-20T13:44:57.744419Z"}, {"uuid": "cc82122e-7c2f-41eb-ab8c-17ebc906a242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mor7wauvu62f", "content": "CRITICAL: iCagenda for Joomla (v1.0.0 \u2013 4.0.7) lets attackers upload + execute PHP files, risking full server compromise. No fix yet \u2014 disable feature or apply WAF rules ASAP. https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla \ud83d\udee1\ufe0f", "creation_timestamp": "2026-06-21T01:30:28.581736Z"}, {"uuid": "a768fefc-26e7-4c97-ab63-900f25f78538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116785507532685788", "content": "CVE-2026-48939 (CRITICAL): iCagenda for Joomla (v1.0.0-3.9.14, 4.0.0-4.0.7) allows unauthenticated PHP file upload & execution. No patch yet \u2014 disable or restrict access, use WAF to block. Full site/server compromise risk. Details: https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla #infosec", "creation_timestamp": "2026-06-21T01:30:29.091535Z"}, {"uuid": "65930e07-941a-445f-b7e1-4d989341cc2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3motlougng225", "content": "Node.js\u30012026\u5e746\u6708\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u306712\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63(CVE-2026-48933,CVE-2026-48618)\u4ed6\n\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "creation_timestamp": "2026-06-22T00:06:27.079098Z"}, {"uuid": "c5cdcddd-1b26-4dc0-84a2-50d5e4dbf52e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48930", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "a6827eba-fe2a-40aa-9f1d-de5f20bf9f02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48931", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "95dc9194-0200-442e-9765-c4fa00395e2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "9cc0fdb1-417f-4953-a0d8-d6694567823e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48934", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "d9805c05-4e6f-4ec2-aeb1-ca9addeef6ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48935", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "da482ff1-5b08-42b7-8fb0-c211f600fe75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48936", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "30f32efc-07ab-4380-a57a-d00e42114866", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48937", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T19:00:00.000000Z"}, {"uuid": "262680c1-f9e0-4899-b58a-3e0abc5aceb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48931", "type": "seen", "source": "https://gist.github.com/muhamedfazalps/a3449070789a6a2c13d4d4e844af803b", "content": "# \u26a0\ufe0f SECURITY ALERT: Multiple CVEs Affecting Popular Packages (June 2026)\n\n## CVE-2026-48931 \u2014 Node.js 24.17 / node-fetch Premature Close\n- **Impact:** Affects Node.js 24.17 and any app using node-fetch\n- **Severity:** High\n- **Affected:** Backstage (20\ud83d\udc4d issue), any Node.js app on 24.17\n- **Fix:** Update Node.js or apply backport\n- **Issue:** https://github.com/backstage/backstage/issues/34651\n\n## CVE-2026-54297 \u2014 Faraday Dependency Vulnerability\n- **Impact:** Affects Fastlane and apps using Faraday\n- **Severity:** High\n- **Affected:** Fastlane (9\ud83d\udc4d issue), any Ruby app using Faraday\n- **Fix:** Update Faraday dependency\n- **Issue:** https://github.com/fastlane/fastlane/issues/30086\n\n## CVE-2026-42530 & CVE-2026-42055 \u2014 nginx Vulnerabilities\n- **Impact:** Affects nginx and mailcow-dockerized\n- **Severity:** High\n- **Affected:** mailcow-dockerized (7\ud83d\udc4d issue), any nginx deployment\n- **Fix:** Update nginx to patched version\n- **Issue:** https://github.com/mailcow/mailcow-dockerized/issues/7299\n\n## js-yaml Quadratic DoS (v3.x)\n- **Impact:** Affects any app using js-yaml v3.x for YAML parsing\n- **Severity:** Medium-High\n- **Affected:** 15\ud83d\udc4d issue requesting backport from v4.2.0 to v3\n- **Fix:** Update to js-yaml v4.2.0+ or apply backport\n- **Issue:** https://github.com/nodeca/js-yaml/issues/762\n\n## How to Check If You're Affected\n1. Check your Node.js version: `node --version`\n2. Check your Ruby/Bundler dependencies: `bundle list | grep faraday`\n3. Check your nginx version: `nginx -v`\n4. Check your js-yaml version: `npm ls js-yaml`\n\n## What to Do\n1. Update affected dependencies immediately\n2. Review logs for suspicious activity\n3. Rotate credentials if exposure is suspected\n\n---\n*If this alert helped you: https://buymeacoffee.com/muhamedfazalps*\n", "creation_timestamp": "2026-06-23T13:41:44.000000Z"}, {"uuid": "2e759e89-9722-4ff8-abae-3350145970ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5vjkhvop2u", "content": "CVE-2026-48933 - Node.js WebCrypto Denial of Service\nCVE ID : CVE-2026-48933\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\n\nTh...", "creation_timestamp": "2026-06-26T02:29:00.087404Z"}, {"uuid": "17d04e9f-807b-4af0-a6a4-67d61876296b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48936", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5vogv5gr2z", "content": "CVE-2026-48936 - Node.js: Insufficient Permissions Check Leading to Unauthorized Socket Server Creation\nCVE ID : CVE-2026-48936\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js Permission API can cause a local server to be started (vi...", "creation_timestamp": "2026-06-26T02:31:44.008833Z"}, {"uuid": "ab841fab-bd6b-4fc0-aee1-8b212c00c36a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48930", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5vtsvk7v27", "content": "CVE-2026-48930 - Node.js TLS Hostname Handling Vulnerability\nCVE ID : CVE-2026-48930\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to...", "creation_timestamp": "2026-06-26T02:34:44.700255Z"}, {"uuid": "d02f7958-d34e-49e7-84cb-f81539b82532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48935", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5wi743io2c", "content": "CVE-2026-48935 - Node.js Permission API File Metadata Modification Vulnerability\nCVE ID : CVE-2026-48935\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was ...", "creation_timestamp": "2026-06-26T02:46:08.325978Z"}, {"uuid": "2b98f057-3cea-4f4a-9947-7e83df4192cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48934", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5xlz53r627", "content": "CVE-2026-48934 - Node.js TLS Host Verification Bypass\nCVE ID : CVE-2026-48934\n \n Published : June 26, 2026, 1:14 a.m. | 30\u00a0minutes ago\n \n Description : A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\n\nThis vulnerability affects...", "creation_timestamp": "2026-06-26T03:06:10.361160Z"}, {"uuid": "d27b5ca8-b7e3-4552-af25-bb7987a26943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48933", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mp64cqknvp2o", "content": "Node.js WebCrypto (v22.22.3, 24.16.0, 26.3.0) faces a HIGH severity bug \u2014 CVE-2026-48933. Integer overflow in subtle.encrypt() can crash Node.js with 2 GiB+ input. Avoid large inputs & watch for patches. \ud83d\udeab https://radar.offseq.com/threat/cve-2026-48933-cwe-190-integer-overflow-in-nodejs--5c33db78...", "creation_timestamp": "2026-06-26T04:30:28.498694Z"}, {"uuid": "91ac0e7a-e79d-4bd2-a8ff-0aa4f896c93f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48933", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116814526921125903", "content": "Node.js WebCrypto in v22.22.3, v24.16.0, v26.3.0 is affected by CVE-2026-48933 (HIGH). Integer overflow in subtle.encrypt() can crash processes with inputs \u2265 2 GiB, causing DoS. Avoid large inputs while awaiting a fix. \ud83d\udd10 https://radar.offseq.com/threat/cve-2026-48933-cwe-190-integer-overflow-in-nodejs--5c33db78fed81dbe #OffSeq #Nodejs #Vuln", "creation_timestamp": "2026-06-26T04:30:31.789409Z"}, {"uuid": "f6771f1b-a5eb-4856-9e12-2421659c80f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48930", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpalhvozva2d", "content": "\ud83d\udccc CVE-2026-48930 - A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver... https://www.cyberhub.blog/cves/CVE-2026-48930", "creation_timestamp": "2026-06-27T04:07:06.651862Z"}, {"uuid": "3e5c0599-d229-4f30-aeae-2e73519dada3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48931", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mpsjwo7hac2k", "content": "CVE-2026-48931 Shouldn't Have Been a CVE \nhttps://adventures.nodeland.dev/archive/cve-2026-48931-shouldnt-have-been-a-cve/", "creation_timestamp": "2026-07-04T07:27:31.104725Z"}, {"uuid": "089c3a53-db85-4a24-a3ff-1e46bb1818d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpwdjdape723", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/B4898F64-5D8B-4A50-BE10-C10F29B49F90", "creation_timestamp": "2026-07-05T19:43:19.156902Z"}, {"uuid": "0e3e73bb-b0a9-4ea6-af4e-e9d672c11839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48931", "type": "seen", "source": "https://bsky.app/profile/sxa.fosstodon.org.ap.brid.gy/post/3mq2dhsxjusx2", "content": "An open, honest review of CVE-2026-48931 in #NodeJS by @mcollina and how the fix for it caused a problem for users of the \"node-fetch@2\" module.\n\nnode-fetch@2 is only receiving security fixes now and is kept active because @3 is an ESM module [1] and so may require some migration to use it. @2 [\u2026]", "creation_timestamp": "2026-07-07T09:53:12.686692Z"}, {"uuid": "928ad704-5f1d-4fd2-b3a1-53f3b6e2fcaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48931", "type": "seen", "source": "https://bsky.app/profile/u11g.com/post/3mqa4iyfwoz2y", "content": "The distinction between routine hardening and a CVE matters \u2014 mis-classified advisories create unnecessary panic and can break more downstream users than the original vulnerability ever would.\n\nhttps://adventures.nodeland.dev/archive/cve-2026-48931-shouldnt-have-been-a-cve", "creation_timestamp": "2026-07-09T17:04:29.033759Z"}, {"uuid": "0ca0bbd1-d8d0-4e95-906d-caf0e915a2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116896829543133479", "content": "CISA has added two vulnerabilities to the KEV catalogue.\n-  CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48939\n-  CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56291 #CISA #infosec #vulnerability", "creation_timestamp": "2026-07-10T17:21:04.761918Z"}, {"uuid": "3049c782-5bd4-44f0-bd93-16c94bc32fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcp6rngha2b", "content": "CVE-2026-48939 - icagenda [known exploited]\nThe iCagenda extension for Joomla allows attackers to upload malicious files, potentially leading to the execution of PHP code. This could compromise the security\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#icagenda #joomlic #CVE #infosec", "creation_timestamp": "2026-07-10T17:44:06.935410Z"}, {"uuid": "9a65cd2e-aa10-4798-9e2c-5aae9d583c9f", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/349ea528-8815-4e8a-812a-918abda44b5f", "content": "", "creation_timestamp": "2026-07-10T18:00:02.701206Z"}, {"uuid": "b45bc1a1-6801-4c16-8b4e-503de277637b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e8ce3b4b-518e-4cc5-ad71-9781806a54ef", "content": "", "creation_timestamp": "2026-07-10T18:00:24.561275Z"}, {"uuid": "67235208-0c79-4d47-9f64-abd35b53e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqcr534agp2j", "content": "\ud83d\uded1 CVE-2026-48939\niCagenda iCagenda\nCVSS 10.0 / EPSS 1% / KEV \u2705\nTL;DR: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files \u2026\nhttps://cvesentinel.com/report/CVE-2026-48939?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-07-10T18:18:56.671002Z"}, {"uuid": "a16f6222-bd3f-4cfa-b52a-289d73661f46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mqcww6zvhz2f", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48939 iCagenda Unrestricted Upload\u2026\n\n\ud83d\udd17 https://hnow.live/a/1160719f", "creation_timestamp": "2026-07-10T20:02:28.893487Z"}, {"uuid": "1c5306a1-1caa-4f7d-9b50-b86f614471cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6961009", "content": "2026-07-10: [CVE-2026-48939] iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityiCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\ncisakev", "creation_timestamp": "2026-07-10T21:00:25.313943Z"}, {"uuid": "e370c894-aca2-4d93-aff9-c4e1429c8503", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdek725kc2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/394E4504-A538-422A-9DE6-D5EC7D4CA278", "creation_timestamp": "2026-07-11T00:06:18.378442Z"}, {"uuid": "6aeaae95-3095-4bed-a781-4fb73d453c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdgjw633j2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/A1AB5475-6F6B-416C-A06D-67A3D02545AD", "creation_timestamp": "2026-07-11T00:41:56.155499Z"}, {"uuid": "84d4af59-6abe-4846-93a1-8873f69daa27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mqdgk5sbg326", "content": "Joomla iCagenda \u63d2\u4ef6\u6f0f\u6d1e CVE-2026-48939:\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u98ce\u9669\u4e0e\u5b89\u5168\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/5DD651F3-1137-44AF-A3D0-A0FD2F28CEA2", "creation_timestamp": "2026-07-11T00:42:04.147611Z"}, {"uuid": "7d522890-0343-4303-8252-2d01cf761e3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116907369274600216", "content": "\ud83d\udcf0 CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog\n\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-joomla-icagenda-balbooa-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-07-12T14:01:28.613265Z"}, {"uuid": "dc656c8a-c364-425d-b3e2-7cd83342b734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqhdpsawu725", "content": "\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-12T14:02:12.055669Z"}, {"uuid": "7c51b982-5d79-44bb-aae8-94e7c2d87699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqj5wg6v462s", "content": "\ud83e\udd16 CVE-2026-48939 & CVE-2026-56291 (CVSS 10.0): Two Joomla extensions exploited as zero-days in the wild. Unauthenticated RCE via file upload. CISA KEV added.\nhttps://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "creation_timestamp": "2026-07-13T07:23:50.742722Z"}, {"uuid": "87dff641-3a17-4cf4-9177-743e485882b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfhw4p3627", "content": "CVE-2026-56291 and CVE-2026-48939: Joomla Extensions Expose Unpatched Risk #Joomla #Cybersecurity #Vulnerability", "creation_timestamp": "2026-07-13T09:38:54.191237Z"}, {"uuid": "bd5734e8-c0e2-466a-92ac-69dfab203c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfhxw7if2k", "content": "CVE-2026-56291 and CVE-2026-48939: Joomla Extensions Expose Untracked Risks #CyberSecurity #Vulnerabilities #Joomla", "creation_timestamp": "2026-07-13T09:38:56.499096Z"}, {"uuid": "fa3d19d9-6a59-4459-8f2d-b6b622618848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfm3n2vp2f", "content": "CVE-2026-56291 and CVE-2026-48939: Urgency or Overreaction in Joomla's Security Response? #Joomla #CyberSecurity #VulnerabilityManagement", "creation_timestamp": "2026-07-13T09:41:14.735415Z"}, {"uuid": "95d80818-d334-412c-875c-ec17fc26b177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild.\n\nThe vulnerabilities, both rated 10.0 on the CVSS scoring system, are below -\n\n\n  CVE-2026-48939 - A vulnerability in the", "creation_timestamp": "2026-07-13T10:00:54.425715Z"}, {"uuid": "8c80d245-24b1-404c-99ce-425aceb7003a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqjkw6a7ow2x", "content": "Rapid reaction gets you ahead. 10 days before CISA added CVE-2026-48939 a critical Remote Code Execution vulnerability in iCagenda extension for Joomla to KEV, watchTowr clients were aware of their exposure.\n\nReach o\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2076624767352799698)", "creation_timestamp": "2026-07-13T11:16:21.638307Z"}, {"uuid": "49d9496e-09ce-4584-8d76-14037e70c860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mqkmnbpmtc2n", "content": "Monday\u2019s fuck up - this Time - Joomla - \u200aCISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities. CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Actively Exploited!\nthecyberexpress.com/cisa-cve-202... #joomla #exploit #0day #CISA #cve-2026-48939 #cve-2026-56291 #iCagenda #Balbooa", "creation_timestamp": "2026-07-13T11:20:07.768487Z"}, {"uuid": "62cdebec-b4bd-41d2-9094-1d8da61a1af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mqjnevryg32s", "content": "Joomla extensions iCagenda and Balbooa Forms have KEV-listed zero-day flaws reportedly exploited in the wild (CVE-2026-48939, CVSS 10). Patch and audit sites for exposure. #Cybersecurity #Vulnerability #ZeroDay\n\nSource: https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "creation_timestamp": "2026-07-13T12:00:23.549188Z"}, {"uuid": "c9a14170-efbd-46c5-9a78-9572ac2d38f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://dnsc.ro/citeste/alerta-vulnerabilitati-exploatate-activ-in-joomla", "content": "", "creation_timestamp": "2026-07-13T12:15:11.100335Z"}, {"uuid": "af317c3a-2f9f-4fcd-a0a3-29d6be74e7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mqjplozg4p2v", "content": "U.S. CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms). CVE-2026-48939, with a CVSS score of 10.0, allows arbitrary file uploads leading to PHP code execution.", "creation_timestamp": "2026-07-13T12:39:57.968334Z"}, {"uuid": "d1caae61-74ca-44d6-9176-7cc985c80ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbegj7q27", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla Extensions Are Under Siege #Joomla #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-13T15:33:09.576478Z"}, {"uuid": "8c6a9c59-2f8c-49df-b80d-2ca7ed4a1687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbgc4ui2h", "content": "CVE-2026-48939 and CVE-2026-56291 Expose Joomla Sites to RCE \u2014 Immediate Action Required #Joomla #CyberSecurity #RCE", "creation_timestamp": "2026-07-13T15:33:11.152529Z"}, {"uuid": "baa6453d-6cdf-4f74-9ed2-de794c7bde9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbicek42j", "content": "CVE-2026-48939: Joomla's Remote Code Execution Flaws Demand Immediate Attention #Joomla #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-13T15:33:13.543414Z"}, {"uuid": "c7f8050b-f003-4be0-81b3-a7c227f2fe78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbkb6l322", "content": "CVE-2026-48939: CISA Urges Immediate Response to Joomla Flaws, But Will It Matter? #CVE2026 #JoomlaSecurity #Cybersecurity", "creation_timestamp": "2026-07-13T15:33:15.654282Z"}, {"uuid": "33b1713c-88bd-4ebe-a5ad-fa6f9622f7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzfhqffb2p", "content": "CVE-2026-48939: Exploit Development or Poor Vendor Responsibility? #CVE2026 #CyberSecurity #VendorResponsibility", "creation_timestamp": "2026-07-13T15:35:27.010527Z"}, {"uuid": "0b365aec-d639-4e00-a842-713c6fcfc05b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqkdz6s6c22d", "content": "CISA flags active RCE exploitation in Joomla extensions iCagenda and Balbooa Forms. Arbitrary file upload flaws in CVE-2026-48939 and CVE-2026-56291 can lead to full site compromise. #Joomla #iCagenda #BalbooaForms", "creation_timestamp": "2026-07-13T18:45:25.909321Z"}, {"uuid": "5de3f46f-7285-49d2-b2e2-75dd93fdc9a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116914226485690947", "content": "\ud83d\udcf0 CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog\n\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-joomla-icagenda-balbooa-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-07-13T19:05:21.641222Z"}, {"uuid": "0f0361e0-5b08-4ce0-8106-33692121702e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqkf637sbx2u", "content": "\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-13T19:06:03.977973Z"}, {"uuid": "e906a2a7-b18b-4ad0-9439-4e92ee09e0c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:12.148385Z"}, {"uuid": "3e192268-57b6-4968-b984-67aaad45ab62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:17.249965Z"}, {"uuid": "39c74641-04a6-4f61-871d-318edeac53f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:20.353002Z"}, {"uuid": "804b8f38-e296-43f1-b11f-98020ee36f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.748343Z"}, {"uuid": "fc1c466f-99bb-4a47-aa75-cbf53d595b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild.\n\nThe vulnerabilities, both rated 10.0 on the CVSS scoring system, are below -\n\n\n  CVE-2026-48939 - A vulnerability in the", "creation_timestamp": "2026-07-14T01:00:43.112783Z"}, {"uuid": "8540525d-360a-4675-9527-649bc42c6d9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqli7q37zh2a", "content": "CISA warns of actively exploited RCE flaws in Joomla extensions (CVE-2026-48939 and CVE-2026-56291) #patchmanagement", "creation_timestamp": "2026-07-14T05:33:19.981646Z"}, {"uuid": "99d3f4a8-841a-4a57-82a3-890a75725fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqloi5uyei22", "content": "\ud83d\udcf0 CISA Peringatkan Celah Kritis pada Ekstensi Joomla yang Sedang Dieksploitasi untuk Serangan RCE\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/14/cisa-peringatkan-kerentanan-joomla-rce/\n\n#balbooaForms #cisa #cve-2026-48939 #cve-2026-56291 #cyberSecurity #icagenda #joomla #rce", "creation_timestamp": "2026-07-14T07:25:25.422934Z"}, {"uuid": "d60f521c-c648-4502-9052-66c18a208957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mqm3x766yk2r", "content": "Two Joomla extensions hit maximum severity. CISA confirms they're being exploited as zero-days.\n\nCVE-2026-48939.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-56291-balbooa-forms-unauthenticated-rce-exploited/\n\n#InfoSec #ThreatIntel", "creation_timestamp": "2026-07-14T11:26:28.551369Z"}, {"uuid": "950979ac-1e4a-4fb7-bf74-3ec3d54d17d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6hx5gaj2k", "content": "CVE-2026-48939: Joomla Extensions\u2019 Perfect 10 Scores Are a Cyber Crisis #Cybersecurity #Joomla #CVE2026", "creation_timestamp": "2026-07-14T12:11:38.540719Z"}, {"uuid": "75510b22-d650-4877-b861-90a54bfba8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6i2mdqu2g", "content": "CVE-2026-48939: Attackers Leverage Critical Joomla Extensions Flaws for RCE #CVE202648939 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:41.921644Z"}, {"uuid": "0aa56b04-2e95-4ed0-8cac-8575413b2dde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6i637wp2p", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla\u2019s Exploitation Exposes Security Gaps Amid Inaction #Joomla #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-14T12:11:45.724036Z"}, {"uuid": "abe1354d-b265-47a9-95cf-4c9f86646784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6iced2d26", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla Extensions Fail to Protect Users #CVE2026 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:50.511885Z"}, {"uuid": "d4eac64f-a199-443a-b0d0-b32c66599acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6ifkonh2f", "content": "CVE-2026-48939: Joomla's Perfect 10 Vulnerabilities Show Attribution Gaps #CVE202648939 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:53.337201Z"}, {"uuid": "65d24a71-360e-408e-805a-96b65518f25d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6ijcdoa2o", "content": "CVE-2026-48939 and CVE-2026-56291: Are Joomla Patches Enough? #Joomla #Cybersecurity #Vulnerabilities", "creation_timestamp": "2026-07-14T12:11:57.537060Z"}, {"uuid": "febfee6a-0c45-4e1c-a528-5f77465bd15f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.899026Z"}, {"uuid": "5411a266-f772-46c7-bc26-9c2cf02d7258", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:24.063656Z"}, {"uuid": "e1af6c53-cdbd-4345-9bf6-c1f9750dc13a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://gist.github.com/alon710/1e41cbc3b54c1c25a3d44fc7a523b70b", "content": "# CVE-2026-48939: CVE-2026-48939: Unauthenticated Remote Code Execution in Joomla iCagenda Extension\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-06-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48939\n\n## Summary\nCVE-2026-48939 is a critical vulnerability in the iCagenda events calendar extension for Joomla that allows unauthenticated remote attackers to execute arbitrary code via unrestricted file uploads. The flaw stems from a lack of server-side validation of file uploads and missing authorization checks at the controller level. Successful exploitation results in complete compromise of the affected web application host.\n\n## TL;DR\nUnauthenticated arbitrary file upload in iCagenda allows remote code execution via direct POST requests to controller endpoints.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-434, CWE-284\n- **Attack Vector**: Network\n- **CVSS Score**: 10.0 (Critical)\n- **Exploit Status**: Active exploitation in the wild\n- **CISA KEV Status**: Listed on July 10, 2026\n\n## Affected Systems\n\n- Joomla instances running iCagenda 3.2.1 through 3.9.14\n- Joomla instances running iCagenda 4.0.0 through 4.0.7\n- **iCagenda**: >= 3.2.1, < 3.9.15 (Fixed in: `3.9.15`)\n- **iCagenda**: >= 4.0.0, < 4.0.8 (Fixed in: `4.0.8`)\n\n## Mitigation\n\n- Upgrade iCagenda extension to version 4.0.8 (for Joomla 4.x/5.x/6.x) or 3.9.15 (for legacy Joomla 3.x)\n- Configure web server rules to deny script execution inside the /images/ directory\n- Temporarily rename or delete the com_icagenda directories if patching is delayed\n\n**Remediation Steps:**\n1. Navigate to Joomla administrator panel and check the version of the iCagenda component.\n2. Download the patched package (4.0.8 or 3.9.15) from the official iCagenda website.\n3. Install the update via the Joomla Extension Manager to replace vulnerable files.\n4. Verify the directory /images/icagenda/frontend/attachments/ for any suspicious PHP files.\n5. Implement server-level execution blockings using Apache .htaccess or Nginx configuration blocks.\n\n## References\n\n- [mySites.guru Zero-Day Advisory](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939)\n- [National Vulnerability Database (NVD) CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)\n- [CVE Org Authority Entry](https://www.cve.org/CVERecord?id=CVE-2026-48939)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48939) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-16T07:01:40.210426Z"}, {"uuid": "3302eab6-fd56-48e3-9100-dfc0393158ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-16T19:00:27.522934Z"}, {"uuid": "cd3d4b77-bbde-4be8-b6b2-265dafaf65af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-16T19:00:27.632423Z"}, {"uuid": "b3f9023e-99df-404d-9734-d8cd8b8b5635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-17T00:00:44.303009Z"}, {"uuid": "a47e6b95-0647-4324-9b85-ab2e4aa405e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-17T00:00:44.425414Z"}, {"uuid": "238aa55c-fbbb-42b8-b686-ad3c2a60a6c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48933", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mquvxltxdc2s", "content": "\u300cNode.js\u300d\u306b12\u4ef6\u306e\u8106\u5f31\u6027 - \u4fee\u6b63\u7248\u3092\u516c\u958b\n\n\u300cNode.js\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u3001\u958b\u767a\u30c1\u30fc\u30e0\u306f\u73fe\u5730\u6642\u95932026\u5e746\u670818\u65e5\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u300cNode.js 26.3.1\u300d\u300c\u540c24.17.0\u300d\u300c\u540c22.23.0\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\n\n...\n\n\u300cCVE-2026-48933\u300d\u306f\u3001\u300cWebCrypto\u300d\u306b\u304a\u3051\u308b\u5b9f\u88c5\u306e\u4e0d\u5099\u306b\u3088\u308a\u3001AES\u51e6\u7406\u306b\u304a\u3044\u3066\u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u304c\u751f\u3058\u3001\u30d7\u30ed\u30bb\u30b9\u304c\u30af\u30e9\u30c3\u30b7\u30e5\u3059\u308b\u8106\u5f31\u6027\u3002\u307e\u305f\u3001Unicode\u30c9\u30c3\u30c8\u533a\u5207\u308a\u6587\u5b57\u306e\u51e6\u7406\u306b\u8d77\u56e0\u3059\u308bTLS\u306e\u30db\u30b9\u30c8\u540d\u51e6\u7406\u306b\u554f\u984c\u304c\u3042\u308a\u3001\u30ef\u30a4\u30eb\u30c9\u30ab\u30fc\u30c9\u8a3c\u660e\u66f8\u306e\u691c\u8a3c\u304c\u56de\u907f\u3055\u308c\u308b\u300cCVE-2026-48618\u300d\u3092\u4fee\u6b63\u3057\u3066\u3044\u308b\u3002", "creation_timestamp": "2026-07-17T23:33:18.524489Z"}, {"uuid": "368f8f57-4367-45b1-99a4-7a0e940f61e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-18T01:00:03.946939Z"}, {"uuid": "6141346e-3a66-4083-9bde-2e0e738e830a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-18T01:00:04.104774Z"}, {"uuid": "742fa4b2-3517-40b4-bd05-b064dfe023ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ibPzm16gF0sjZFLJaVULBcK_v0_qnzuuiiBsudPYi66KUg", "content": "", "creation_timestamp": "2026-07-18T13:00:03.996269Z"}, {"uuid": "8b12a735-92a5-42aa-9d17-ee35ba87a182", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94050", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 22:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T23:00:03.529274Z"}, {"uuid": "bfa2c63b-7882-4542-8116-0712ead832f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94050", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 22:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.096591Z"}, {"uuid": "efaab5f4-6387-49c1-9bcb-be2b6c3f7978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "Telegram/ibPzm16gF0sjZFLJaVULBcK_v0_qnzuuiiBsudPYi66KUg", "content": "", "creation_timestamp": "2026-07-19T00:00:28.017771Z"}, {"uuid": "df60e1d5-78c2-4b86-9e86-98e78e912aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-19T00:00:41.609645Z"}, {"uuid": "c7421b8b-e01a-4594-b72b-7aa7be649dc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-19T00:00:41.785712Z"}, {"uuid": "af028700-5972-45e1-a183-53e1b3b14392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-20T18:00:05.301013Z"}, {"uuid": "7ade06d4-6c9a-4818-8368-c0ae1448b72a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-21T00:00:32.276435Z"}, {"uuid": "892bd71f-ecf2-4027-905f-395393e99a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-22T00:00:07.964446Z"}]}