CVE-2026-58644: Microsoft SharePoint — Unauthenticated Deserialization RCE
Microsoft SharePoint Server
Vulnerabilities by Vendor
All Vuln Brief CVE analysis grouped by affected vendor. 89 vendors covered across 192 analysed vulnerabilities.
Microsoft 39 Cisco 11 Fortinet 10 Ivanti 10 Google 4 SonicWall 4 SolarWinds 4 Citrix 3 JetBrains 3 Oracle 3 Palo Alto Networks 3 SimpleHelp 3 Ubiquiti 3 Sangoma 2 Apache Software Foundation 2 Linux 2 F5 2 Atlassian 2 Zyxel 2 Sophos 2 D-Link 2 Adobe 2 PaperCut 2 Progress Software 2 ConnectWise 2 Cleo 2 Apple 2 BerriAI 2 LiteSpeed Technologies 2 Sierra Wireless 1 Synacor 1 Adobe Systems 1 OpenPLC ScadaBR 1 Zoho 1 IBM 1 Fortra (formerly HelpSystems) 1 Juniper 1 KNX Association 1 ownCloud 1 Digiever 1 GitLab 1 PHP Group 1 OpenSSH 1 Samsung 1 TeamT5 1 React Native Community 1 Gladinet 1 WatchGuard 1 MongoDB 1 Notepad++ 1 Kentico 1 Craft CMS 1 Quest 1 Langflow (DataStax) 1 Android Framework 1 Android 1 Roundcube 1 Meta React Server Components 1 OSGeo 1 ASUS 1 RARLAB 1 Array Networks 1 Lantronix 1 n8n 1 PTC 1 BeyondTrust 1 Splunk 1 Broadcom 1 Dell 1 Soliton Systems K.K. 1 SmarterTools 1 Langflow 1 Aqua Security 1 Apache 1 Trend Micro 1 Marimo / CoreWeave 1 WebPros 1 Mirasvit 1 TanStack 1 Nx 1 JoomShaper 1 Widget Factory 1 iCagenda 1 Check Point 1 DataStax / Langflow 1 Joomlack 1 Balbooa 1 Daemon 1 Drupal Association 1
Microsoft
39 CVEs Avg CVSS: 8.5 First: Nov 3, 2021CVE-2026-56155: Microsoft Active Directory Federation Services — Local Privilege Escalation
Active Directory Federation Services
CVE-2026-56164: Microsoft SharePoint Server — Missing Authentication Privilege Escalation
SharePoint Server
CVE-2026-45659: Microsoft SharePoint Server -- Deserialization RCE
SharePoint Server
CVE-2026-41089: Windows Netlogon Pre-Authentication RCE — Unauthenticated Domain Controller Takeover
Windows Netlogon (Windows Server)
CVE-2009-1537: Microsoft DirectX -- MPEG2 Null Byte Overwrite via quartz.dll
Microsoft DirectX (quartz.dll)
CVE-2008-4250: MS08-067 -- Windows Server Service RPC Buffer Overflow (Conficker)
Microsoft Windows (Server Service)
CVE-2010-0249: Internet Explorer -- Operation Aurora Use-After-Free (IE6/IE7 RCE)
Microsoft Internet Explorer
CVE-2010-0806: Internet Explorer -- DHTML Peering Use-After-Free (Drive-By RCE)
Microsoft Internet Explorer
CVE-2026-41091: Microsoft Defender Symlink Following -- Low-Privilege to SYSTEM via Malware Protection Engine
Defender (Microsoft Malware Protection Engine)
CVE-2026-45498: Microsoft Defender -- Denial of Service via Malformed Input
Microsoft Defender Antivirus
CVE-2026-42897: Microsoft Exchange Server XSS in Outlook Web Access
Exchange Server
CVE-2026-33825: Microsoft Defender Insufficient Access Control -- Local Privilege Escalation
Defender
CVE-2023-21529: Microsoft Exchange Server Deserialization -- Authenticated RCE
Exchange Server
CVE-2026-20963: Microsoft SharePoint Deserialization -- Unauthenticated Network RCE
SharePoint Server
CVE-2008-0015: Microsoft Windows Video ActiveX Control -- Remote Code Execution
Windows Video ActiveX Control
CVE-2024-43468: Microsoft Configuration Manager -- Unauthenticated SQL Injection RCE
Microsoft Configuration Manager (SCCM/MEM)
CVE-2026-21510: Microsoft Windows Shell -- Protection Mechanism Failure
Windows Shell
CVE-2026-21513: Microsoft Windows MSHTML -- Protection Mechanism Failure
Windows MSHTML
CVE-2026-21514: Microsoft Office Word -- Reliance on Untrusted Inputs Privilege Escalation
Microsoft Office Word
CVE-2026-21519: Microsoft Desktop Window Manager -- Type Confusion Privilege Escalation
Windows Desktop Window Manager (DWM)
CVE-2026-21533: Microsoft Windows Remote Desktop Services -- Privilege Escalation
Windows Remote Desktop Services
CVE-2025-62221: Microsoft Windows Cloud Files Mini Filter Driver -- Use-After-Free Privilege Escalation
Windows Cloud Files Mini Filter Driver
CVE-2025-29824: Windows CLFS -- Zero-Day Privilege Escalation
Windows (CLFS Driver)
CVE-2025-26633: Microsoft MMC -- Zero-Day Security Feature Bypass
Microsoft Management Console
CVE-2025-21418: Windows AFD Driver -- Privilege Escalation
Windows AFD Driver
CVE-2024-43451: Windows -- NTLM Hash Disclosure Spoofing
Windows
CVE-2024-49039: Windows Task Scheduler -- Privilege Escalation
Windows Task Scheduler
CVE-2024-38094: Microsoft SharePoint Server -- Remote Code Execution
SharePoint Server
CVE-2024-38193: Windows AFD Driver -- Privilege Escalation
Windows AFD Driver
CVE-2024-38112: Windows MSHTML -- Platform Spoofing
Windows MSHTML Platform
CVE-2024-26169: Windows Error Reporting -- Privilege Escalation
Windows Error Reporting Service
CVE-2024-30080: Microsoft MSMQ -- Remote Code Execution
Microsoft Message Queuing
CVE-2024-30051: Windows DWM Core Library -- Privilege Escalation
Windows Desktop Window Manager
CVE-2024-21338: Windows Kernel -- Privilege Escalation
Windows Kernel
CVE-2023-36025: Windows SmartScreen -- Security Feature Bypass
Windows SmartScreen
CVE-2022-41040: Microsoft Exchange -- ProxyNotShell SSRF
Exchange Server
CVE-2021-26855: Microsoft Exchange -- ProxyLogon SSRF
Exchange Server
CVE-2021-34473: Microsoft Exchange -- ProxyShell RCE
Exchange Server
Cisco
11 CVEs Avg CVSS: 8.7 First: Oct 16, 2023CVE-2026-20230: Cisco Unified CM — SSRF to Root via Webshell
Unified Communications Manager
CVE-2026-20245: Cisco Catalyst SD-WAN Manager CLI Command Injection — Unpatched Root Privilege Escalation
Catalyst SD-WAN Manager
CVE-2026-20122/20128/20133: Cisco Catalyst SD-WAN Manager Exploitation Chain
Catalyst SD-WAN Manager
CVE-2026-20182: Cisco Catalyst SD-WAN Authentication Bypass -- Unauthenticated Admin Access
Catalyst SD-WAN Controller & Manager
CVE-2026-20131: Cisco FMC Deserialization -- Unauthenticated RCE as Root
Secure Firewall Management Center (FMC) / Security Cloud Control
CVE-2022-20775: Cisco SD-WAN CLI -- Path Traversal Privilege Escalation
Cisco SD-WAN
CVE-2026-20127: Cisco Catalyst SD-WAN Auth Bypass -- Unauthenticated Admin Access
Catalyst SD-WAN Controller and Manager
CVE-2025-20393: Cisco Secure Email -- OS Command Injection with Root Privileges
Secure Email Gateway / AsyncOS / Web Manager
CVE-2024-20353: Cisco ASA/FTD -- ArcaneDoor DoS and Memory Leak
Cisco ASA / Firepower Threat Defense
CVE-2023-20273: Cisco IOS XE Web UI -- Command Injection
Cisco IOS XE
CVE-2023-20198: Cisco IOS XE Web UI -- Zero-Day Privilege Escalation (CVSS 10.0)
IOS XE
Fortinet
10 CVEs Avg CVSS: 9.7 First: Dec 13, 2022CVE-2026-25089: Fortinet FortiSandbox — Unauthenticated OS Command Injection
FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS
CVE-2026-39808: Fortinet FortiSandbox — Second Unauthenticated Command Injection
FortiSandbox
CVE-2026-21643: Fortinet FortiClient EMS Unauthenticated SQL Injection
FortiClient EMS
CVE-2026-35616: Fortinet FortiClient EMS Improper Access Control -- Unauthenticated RCE
FortiClient EMS
CVE-2025-59718: Fortinet FortiOS/FortiProxy/FortiWeb -- SAML Authentication Bypass
FortiOS / FortiProxy / FortiSwitchMaster / FortiWeb
CVE-2024-23113: Fortinet FortiOS -- Format String RCE
FortiOS / FortiProxy / FortiPAM / FortiWeb
CVE-2023-48788: Fortinet FortiClientEMS -- SQL Injection to RCE
FortiClientEMS
CVE-2024-21762: Fortinet FortiOS SSL VPN -- Out-of-Bounds Write RCE
FortiOS
CVE-2023-27997: Fortinet FortiGate SSL-VPN -- Pre-Auth Heap Overflow RCE
FortiOS / FortiProxy
CVE-2022-42475: Fortinet FortiOS -- Heap Overflow RCE
FortiOS
Ivanti
10 CVEs Avg CVSS: 9.1 First: Jul 25, 2023CVE-2026-10520: Ivanti Sentry — Pre-Authentication OS Command Injection (CVSS 10.0)
Sentry (formerly MobileIron Sentry)
CVE-2026-6973: Ivanti EPMM Improper Input Validation Enables Authenticated RCE
Endpoint Manager Mobile (EPMM)
CVE-2026-1340: Ivanti EPMM Unauthenticated Code Injection Enables Full RCE
Endpoint Manager Mobile (EPMM)
CVE-2026-1603: Ivanti EPM Auth Bypass -- Unauthenticated Credential Data Leak
Endpoint Manager (EPM)
CVE-2025-0282: Ivanti Connect Secure -- Stack Overflow Zero-Day RCE
Connect Secure / Policy Secure / Neurons for ZTA
CVE-2024-29824: Ivanti EPM -- SQL Injection to RCE
Endpoint Manager (EPM)
CVE-2024-21893: Ivanti Connect Secure -- SSRF to Authentication Bypass
Connect Secure / Policy Secure
CVE-2023-46805: Ivanti Connect Secure -- Authentication Bypass via Path Traversal
Connect Secure / Policy Secure
CVE-2024-21887: Ivanti Connect Secure -- Authenticated Command Injection
Connect Secure / Policy Secure
CVE-2023-35078: Ivanti EPMM -- Unauthenticated API Access
Endpoint Manager Mobile (EPMM)
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read/Write — Actively Exploited Browser RCE
Chromium V8
CVE-2026-3910: Google Chromium V8 Memory Buffer -- Sandbox RCE via Crafted HTML
Chromium / Chrome
CVE-2026-2441: Google Chromium CSS -- Use-After-Free Heap Corruption
Chromium / Chrome / Edge / Opera
CVE-2025-14174: Google Chromium ANGLE -- Out-of-Bounds Memory Access
Chromium / Chrome / Edge / Opera
SonicWall
4 CVEs Avg CVSS: 8.9 First: Jan 24, 2025CVE-2026-15409: SonicWall SMA1000 WorkPlace — Unauthenticated SSRF (CVSS 10.0)
SMA1000 Appliance
CVE-2026-15410: SonicWall SMA1000 AMC — Code Injection Remote Code Execution
SMA1000 Appliance
CVE-2025-40602: SonicWall SMA1000 -- Missing Authorization Privilege Escalation
SMA1000 Appliance
CVE-2025-23006: SonicWall SMA 1000 -- Pre-Auth Deserialization RCE
SonicWall SMA 1000
SolarWinds
4 CVEs Avg CVSS: 9.1 First: Feb 3, 2026CVE-2026-28318: SolarWinds Serv-U Unauthenticated DoS via Deflate Header
Serv-U
CVE-2025-26399: SolarWinds Web Help Desk Deserialization -- RCE via AjaxProxy
Web Help Desk
CVE-2025-40536: SolarWinds Web Help Desk -- Security Control Bypass
Web Help Desk
CVE-2025-40551: SolarWinds Web Help Desk -- Deserialization RCE
Web Help Desk
Citrix
3 CVEs Avg CVSS: 9.3 First: Nov 8, 2022CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read -- SAML IDP Memory Disclosure
NetScaler ADC / Gateway
CVE-2023-4966: Citrix NetScaler Bleed -- Session Token Leak
NetScaler ADC / NetScaler Gateway
CVE-2022-27510: Citrix ADC/Gateway -- Authentication Bypass
Citrix ADC / Citrix Gateway
JetBrains
3 CVEs Avg CVSS: 9.0 First: Oct 4, 2023Oracle
3 CVEs Avg CVSS: 9.0 First: Jun 2, 2026CVE-2026-46817: Oracle E-Business Suite Payments — Unauthenticated Remote Code Execution
E-Business Suite (EBS) 12.2
CVE-2026-35273: Oracle PeopleSoft PeopleTools — Missing Authentication Enabling Unauthenticated Takeover
PeopleSoft Enterprise PeopleTools
CVE-2024-21182: Oracle WebLogic Server -- Unauthenticated Information Disclosure via T3/IIOP
WebLogic Server
Palo Alto Networks
3 CVEs Avg CVSS: 9.2 First: Apr 12, 2024SimpleHelp
3 CVEs Avg CVSS: 9.0 First: Apr 24, 2026CVE-2026-48558: SimpleHelp — OIDC Authentication Bypass via Unsigned Token Acceptance
SimpleHelp
CVE-2024-57726: SimpleHelp Missing Authorization -- Privilege Escalation via API Keys
SimpleHelp Remote Support
CVE-2024-57728: SimpleHelp Path Traversal (Zip Slip) -- Arbitrary File Write via Admin Upload
SimpleHelp Remote Support
Ubiquiti
3 CVEs Avg CVSS: 10.0 First: Jun 24, 2026Sangoma
2 CVEs Avg CVSS: 9.3 First: Feb 3, 2026Apache Software Foundation
2 CVEs Avg CVSS: 10.0 First: Dec 10, 2021Linux
2 CVEs Avg CVSS: 7.8 First: May 1, 2026F5
2 CVEs Avg CVSS: 9.3 First: May 10, 2022Atlassian
2 CVEs Avg CVSS: 9.9 First: Jun 2, 2022CVE-2023-22515: Atlassian Confluence -- Privilege Escalation to Admin
Confluence Data Center and Server
CVE-2022-26134: Atlassian Confluence -- OGNL Injection RCE
Confluence Server / Data Center
Zyxel
2 CVEs Avg CVSS: 9.8 First: May 16, 2022CVE-2023-28771: Zyxel Firewall -- Pre-Auth OS Command Injection
Zyxel Firewall
CVE-2022-30525: Zyxel Firewall -- OS Command Injection
Zyxel Firewall
Sophos
2 CVEs Avg CVSS: 9.8 First: Sep 23, 2022CVE-2023-1671: Sophos Web Appliance -- Pre-Auth Command Injection
Sophos Web Appliance
CVE-2022-3236: Sophos Firewall -- User Portal and Webadmin Code Injection
Sophos Firewall
D-Link
2 CVEs Avg CVSS: 8.5 First: Dec 8, 2025Adobe
2 CVEs Avg CVSS: 9.3 First: Mar 15, 2023PaperCut
2 CVEs Avg CVSS: 9.8 First: Apr 21, 2023Progress Software
2 CVEs Avg CVSS: 9.9 First: Jun 2, 2023CVE-2023-40044: Progress WS_FTP Server -- Deserialization RCE
WS_FTP Server
CVE-2023-34362: MOVEit Transfer -- SQL Injection to RCE
MOVEit Transfer
ConnectWise
2 CVEs Avg CVSS: 9.9 First: Feb 22, 2024Cleo
2 CVEs Avg CVSS: 9.3 First: Dec 13, 2024CVE-2024-55956: Cleo MFT -- Unrestricted File Upload to RCE
Harmony / VLTrader / LexiCom
CVE-2024-50623: Cleo Harmony/VLTrader -- Unrestricted File Upload and Download RCE
Harmony / VLTrader / LexiCom
Apple
2 CVEs Avg CVSS: 8.8 First: Dec 15, 2025CVE-2026-20700: Apple Multiple Products -- Buffer Overflow RCE
iOS / macOS / tvOS / watchOS / visionOS
CVE-2025-43529: Apple Multiple Products WebKit -- Use-After-Free Memory Corruption
iOS/iPadOS/macOS/Safari
BerriAI
2 CVEs Avg CVSS: 8.4 First: May 8, 2026LiteSpeed Technologies
2 CVEs Avg CVSS: 9.3 First: May 27, 2026CVE-2026-54420: LiteSpeed cPanel Plugin — UNIX Symlink Following Allows Container Escape on Shared Hosting
LiteSpeed cPanel Plugin
CVE-2026-48172: LiteSpeed cPanel Plugin -- Root Privilege Escalation via redisAble API
LiteSpeed cPanel Plugin
Sierra Wireless
1 CVE Avg CVSS: 8.8 First: Dec 12, 2025Synacor
1 CVE Avg CVSS: 9.8 First: Feb 17, 2026CVE-2020-7796: Synacor Zimbra Collaboration Suite -- SSRF via WebEx Zimlet
Zimbra Collaboration Suite (ZCS)
Adobe Systems
1 CVE Avg CVSS: 9.3 First: May 20, 2026CVE-2009-3459: Adobe Acrobat and Reader -- Heap-Based Buffer Overflow via Malicious PDF
Adobe Acrobat and Reader
OpenPLC ScadaBR
1 CVE Avg CVSS: 8.8 First: Dec 3, 2025Zoho
1 CVE Avg CVSS: 9.8 First: Nov 3, 2021CVE-2021-40539: Zoho ManageEngine ADSelfService Plus -- Unauthenticated RCE
ManageEngine ADSelfService Plus
IBM
1 CVE Avg CVSS: 9.8 First: Feb 21, 2023Fortra (formerly HelpSystems)
1 CVE Avg CVSS: 7.2 First: Feb 10, 2023Juniper
1 CVE Avg CVSS: 9.8 First: Nov 13, 2023CVE-2023-36844: Juniper SRX/EX -- PHP Environment Variable Injection
Juniper SRX / EX Series
KNX Association
1 CVE Avg CVSS: 7.5 First: Jul 16, 2026ownCloud
1 CVE Avg CVSS: 10.0 First: Nov 30, 2023CVE-2023-49103: ownCloud graphapi -- Sensitive Information Disclosure (CVSS 10.0)
ownCloud (graphapi app)
Digiever
1 CVE Avg CVSS: 9.8 First: Dec 22, 2025GitLab
1 CVE Avg CVSS: 10.0 First: May 1, 2024PHP Group
1 CVE Avg CVSS: 9.8 First: Jun 12, 2024CVE-2024-4577: PHP CGI -- Argument Injection RCE on Windows
PHP (CGI mode on Windows)
OpenSSH
1 CVE Avg CVSS: 8.1 First: Jul 1, 2024Samsung
1 CVE Avg CVSS: 9.8 First: Apr 24, 2026TeamT5
1 CVE Avg CVSS: 7.2 First: Feb 17, 2026CVE-2024-7694: TeamT5 ThreatSonar Anti-Ransomware -- Unrestricted File Upload RCE
ThreatSonar Anti-Ransomware
React Native Community
1 CVE Avg CVSS: 9.8 First: Feb 5, 2026CVE-2025-11953: React Native Community CLI -- Metro Dev Server OS Command Injection
React Native CLI / Metro Development Server
Gladinet
1 CVE Avg CVSS: 9.1 First: Dec 15, 2025CVE-2025-14611: Gladinet CentreStack/Triofox -- Hardcoded Cryptographic Keys
CentreStack / Triofox
WatchGuard
1 CVE Avg CVSS: 9.8 First: Dec 19, 2025CVE-2025-14733: WatchGuard Firebox -- Out-of-Bounds Write RCE via IKEv2
Firebox / Fireware OS
MongoDB
1 CVE Avg CVSS: 7.5 First: Dec 29, 2025Notepad++
1 CVE Avg CVSS: 7.5 First: Feb 12, 2026CVE-2025-15556: Notepad++ WinGUp Updater -- Download Without Integrity Check
Notepad++ (WinGUp updater)
Kentico
1 CVE Avg CVSS: 7.5 First: Apr 20, 2026Craft CMS
1 CVE Avg CVSS: 9.8 First: Mar 20, 2026Quest
1 CVE Avg CVSS: 9.8 First: Apr 20, 2026CVE-2025-32975: Quest KACE Systems Management Appliance Improper Authentication
KACE Systems Management Appliance (SMA)
Langflow (DataStax)
1 CVE Avg CVSS: 9.8 First: May 21, 2026Android Framework
1 CVE Avg CVSS: 7.8 First: Dec 2, 2025CVE-2025-48572: Android Framework -- Privilege Escalation Vulnerability
Android Framework
Android
1 CVE Avg CVSS: 8.4 First: Jun 3, 2026Roundcube
1 CVE Avg CVSS: 8.8 First: Feb 20, 2026Meta React Server Components
1 CVE Avg CVSS: 9.8 First: Dec 5, 2025CVE-2025-55182: Meta React Server Components -- Unauthenticated RCE
React Server Components
OSGeo
1 CVE Avg CVSS: 7.5 First: Dec 11, 2025ASUS
1 CVE Avg CVSS: 7.5 First: Dec 17, 2025RARLAB
1 CVE Avg CVSS: 7.8 First: Dec 9, 2025Array Networks
1 CVE Avg CVSS: 9.8 First: Dec 8, 2025Lantronix
1 CVE Avg CVSS: 9.8 First: Jun 24, 2026n8n
1 CVE Avg CVSS: 9.8 First: Mar 11, 2026CVE-2025-68613: n8n Workflow Automation RCE -- Expression Evaluation Code Injection
n8n Workflow Automation
PTC
1 CVE Avg CVSS: 9.3 First: Jun 25, 2026CVE-2026-12569: PTC Windchill — Unauthenticated Deserialization RCE
Windchill PDMLink / FlexPLM
BeyondTrust
1 CVE Avg CVSS: 9.8 First: Feb 13, 2026CVE-2026-1731: BeyondTrust Remote Support OS Command Injection -- Unauthenticated RCE
Remote Support / Privileged Remote Access
Splunk
1 CVE Avg CVSS: 9.8 First: Jun 19, 2026Broadcom
1 CVE Avg CVSS: 9.8 First: Mar 3, 2026CVE-2026-22719: VMware Aria Operations Command Injection -- Unauthenticated RCE via Migration
VMware Aria Operations (vRealize Operations)
Dell
1 CVE Avg CVSS: 9.8 First: Feb 18, 2026CVE-2026-22769: Dell RecoverPoint for VMs -- Hard-Coded Credentials
RecoverPoint for Virtual Machines (RP4VMs)
Soliton Systems K.K.
1 CVE Avg CVSS: 8.8 First: Feb 24, 2026SmarterTools
1 CVE Avg CVSS: 9.8 First: Feb 5, 2026Langflow
1 CVE Avg CVSS: 9.8 First: Mar 25, 2026Aqua Security
1 CVE Avg CVSS: 9.5 First: Mar 26, 2026Apache
1 CVE Avg CVSS: 8.8 First: Apr 16, 2026Trend Micro
1 CVE Avg CVSS: 7.5 First: May 21, 2026Marimo / CoreWeave
1 CVE Avg CVSS: 9.8 First: Apr 23, 2026WebPros
1 CVE Avg CVSS: 9.8 First: Apr 30, 2026Mirasvit
1 CVE Avg CVSS: 9.8 First: Jun 4, 2026CVE-2026-45247: Mirasvit Full Page Cache Warmer — Unauthenticated PHP Object Injection RCE
Full Page Cache Warmer for Magento 2
TanStack
1 CVE Avg CVSS: 9.6 First: May 28, 2026Nx
1 CVE Avg CVSS: 9.8 First: May 28, 2026JoomShaper
1 CVE Avg CVSS: 10.0 First: Jul 8, 2026Widget Factory
1 CVE Avg CVSS: 10.0 First: Jun 17, 2026CVE-2026-48907: Joomla Content Editor — Unauthenticated RCE via File Upload
Joomla Content Editor (JCE)
iCagenda
1 CVE Avg CVSS: 9.8 First: Jul 10, 2026CVE-2026-48939: iCagenda -- Dual-Path File Upload RCE and Access Control Bypass
iCagenda (Joomla component)
Check Point
1 CVE Avg CVSS: 9.3 First: Jun 9, 2026DataStax / Langflow
1 CVE Avg CVSS: 9.9 First: Jul 8, 2026Joomlack
1 CVE Avg CVSS: 9.8 First: Jul 8, 2026Balbooa
1 CVE Avg CVSS: 9.8 First: Jul 10, 2026CVE-2026-56291: Balbooa Forms -- Unauthenticated File Upload RCE in Joomla
Balbooa Forms (Joomla extension)
Daemon
1 CVE Avg CVSS: 9.8 First: May 28, 2026Drupal Association
1 CVE Avg CVSS: 8.1 First: May 22, 2026No vendors match your search.