[vulnfeed] 9 critical CVEs — 2026-08-22 16:00 UTC
vulnfeed
Critical alert — 2026-08-22 16:46 UTC
9 new critical CVEs
in the last 5 hours — 9 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-76604CRITICAL
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The PHP form element is vulnerable to the execution of user provided codes.
CVSS 10.0
CVE-2026-76605CRITICAL
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVSS 10.0
CVE-2026-76606CRITICAL
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
CVSS 10.0
CVE-2026-76607CRITICAL
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.
Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.3 - ???.
CVSS 10.0
CVE-2026-4703CRITICAL
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from
CVSS 9.8
CVE-2026-77992CRITICAL
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUp
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks.
CVSS 9.5
CVE-2026-63310CRITICAL
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downl
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject m
CVSS 9.3
CVE-2026-76571CRITICAL
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik <
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the
CVSS 9.3
CVE-2026-76602CRITICAL
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order para
Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.3 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.
CVSS 9.3
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: