{"vulnerability": "CVE-2026-48939", "sightings": [{"uuid": "2897e412-7bed-47be-932c-81df65c45d1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-48939.yaml", "content": "", "creation_timestamp": "2026-08-08T00:02:13.038157Z"}, {"uuid": "8f588e02-c0d4-44b2-9f30-52370ea9dea3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/pphm_HackerNews/1987", "content": "\ud83d\udd34 Two Critical Joomla Flaws Exploited as Zero-Days\n\nCISA has added two maximum-severity vulnerabilities to its Known Exploited \n\nVulnerabilities catalog:\n\n\u26a0\ufe0f CVE-2026-48939: iCagenda arbitrary file upload\n\n\u26a0\ufe0f CVE-2026-56291: Balbooa Forms unauthenticated remote code execution\n\nBoth flaws carry a CVSS score of 10.0\n\nAttackers can upload malicious PHP files and deploy web shells", "creation_timestamp": "2026-08-21T23:00:09.265293Z"}, {"uuid": "8b27ef04-984e-43f7-a647-7e138b63026c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-48939.yaml", "content": "", "creation_timestamp": "2026-08-09T09:00:03.097279Z"}, {"uuid": "055408a8-d99c-46c6-8f2c-16080c7e5e4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-48939.yaml", "content": "", "creation_timestamp": "2026-08-10T00:00:06.284840Z"}, {"uuid": "ead1cf0c-38c2-4eff-a4e4-60bc0a9e547a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mopyiqfnx42t", "content": "CVE-2026-48939 - Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla\nCVE ID : CVE-2026-48939\n \n Published : June 20, 2026, 11:56 a.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : A vulnerability in the iCagenda extension for Joomla allows the ...", "creation_timestamp": "2026-06-20T13:44:57.744419Z"}, {"uuid": "cc82122e-7c2f-41eb-ab8c-17ebc906a242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mor7wauvu62f", "content": "CRITICAL: iCagenda for Joomla (v1.0.0 \u2013 4.0.7) lets attackers upload + execute PHP files, risking full server compromise. No fix yet \u2014 disable feature or apply WAF rules ASAP. https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla \ud83d\udee1\ufe0f", "creation_timestamp": "2026-06-21T01:30:28.581736Z"}, {"uuid": "a768fefc-26e7-4c97-ab63-900f25f78538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116785507532685788", "content": "CVE-2026-48939 (CRITICAL): iCagenda for Joomla (v1.0.0-3.9.14, 4.0.0-4.0.7) allows unauthenticated PHP file upload & execution. No patch yet \u2014 disable or restrict access, use WAF to block. Full site/server compromise risk. Details: https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla #infosec", "creation_timestamp": "2026-06-21T01:30:29.091535Z"}, {"uuid": "8994479c-53a2-465d-bff6-8345301fac89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-48939.yaml", "content": "", "creation_timestamp": "2026-08-06T09:00:05.456870Z"}, {"uuid": "15c46613-e8e3-4ce5-b86b-48b08c95b8ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/pphm_HackerNews/1987", "content": "\ud83d\udd34 Two Critical Joomla Flaws Exploited as Zero-Days\n\nCISA has added two maximum-severity vulnerabilities to its Known Exploited \n\nVulnerabilities catalog:\n\n\u26a0\ufe0f CVE-2026-48939: iCagenda arbitrary file upload\n\n\u26a0\ufe0f CVE-2026-56291: Balbooa Forms unauthenticated remote code execution\n\nBoth flaws carry a CVSS score of 10.0\n\nAttackers can upload malicious PHP files and deploy web shells", "creation_timestamp": "2026-08-22T00:00:26.493069Z"}, {"uuid": "089c3a53-db85-4a24-a3ff-1e46bb1818d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpwdjdape723", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/B4898F64-5D8B-4A50-BE10-C10F29B49F90", "creation_timestamp": "2026-07-05T19:43:19.156902Z"}, {"uuid": "c770d824-3b0a-4146-bd47-6f41c770b63c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-48939.yaml", "content": "", "creation_timestamp": "2026-08-07T00:00:03.434870Z"}, {"uuid": "0ca7ba3a-0bf1-46d9-b218-ee51876a0483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mstfhme7qs26", "content": "\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001iCagenda\u3068Balbooa Forms\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09 \u306f\u3001iCagenda\u3068Balbooa Forms\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3055\u308c\u305f\u4e0d\u5177\u5408\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002\n\nCVE-2026-48939  \uff08CVSS\u30b9\u30b3\u30a210.0\uff09iCagenda\u306b\u304a\u3051\u308b\u5371\u967a\u306a\u30bf\u30a4\u30d7\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u7121\u5236\u9650\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306e\u8106\u5f31\u6027\nCVE-2026-56291  Balbo...", "creation_timestamp": "2026-08-11T19:55:45.147777Z"}, {"uuid": "4c4c756f-7df3-4a23-8d94-c39e441c7152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mstfxfwgus26", "content": "Joomla\u5411\u3051\u6a5f\u80fd\u62e1\u5f35\u300ciCagenda\u300d\u300cBalbooa Forms\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u306b\u6ce8\u610f\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u300cJoomla\u300d\u5411\u3051\u62e1\u5f35\u6a5f\u80fd\u300ciCagenda\u300d\u300cBalbooa Forms\u300d\u306e\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u5bfe\u7b56\u3092\u547c\u3073\u304b\u3051\u305f\u3002\n\nCISA\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670810\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u30782\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-48939\u300d\u300cCVE-2026-56291\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u3053\u308c\u3089\u8106\u5f31\u306a\u6a5f\u80fd\u62e1\u5f35\u304c\u5c0e\u5165\u3055\u308c\u305f\u30b3\u30f3\u30c6\u30f3\u30c4\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b7\u30b9\u30c6\u30e0\u300cJoomla\u300d\u306e\u7a3c\u50cd\u74b0\u5883\u3067\u306f\u3001\u5f62\u5f0f\u3092\u554f\u308f\u305a\u5236\u9650\u306a\u3057\u306b\u30d5...", "creation_timestamp": "2026-08-11T20:04:34.767196Z"}, {"uuid": "0ca0bbd1-d8d0-4e95-906d-caf0e915a2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116896829543133479", "content": "CISA has added two vulnerabilities to the KEV catalogue.\n-  CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48939\n-  CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56291 #CISA #infosec #vulnerability", "creation_timestamp": "2026-07-10T17:21:04.761918Z"}, {"uuid": "3049c782-5bd4-44f0-bd93-16c94bc32fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcp6rngha2b", "content": "CVE-2026-48939 - icagenda [known exploited]\nThe iCagenda extension for Joomla allows attackers to upload malicious files, potentially leading to the execution of PHP code. This could compromise the security\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#icagenda #joomlic #CVE #infosec", "creation_timestamp": "2026-07-10T17:44:06.935410Z"}, {"uuid": "9a65cd2e-aa10-4798-9e2c-5aae9d583c9f", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/349ea528-8815-4e8a-812a-918abda44b5f", "content": "", "creation_timestamp": "2026-07-10T18:00:02.701206Z"}, {"uuid": "b45bc1a1-6801-4c16-8b4e-503de277637b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e8ce3b4b-518e-4cc5-ad71-9781806a54ef", "content": "", "creation_timestamp": "2026-07-10T18:00:24.561275Z"}, {"uuid": "67235208-0c79-4d47-9f64-abd35b53e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqcr534agp2j", "content": "\ud83d\uded1 CVE-2026-48939\niCagenda iCagenda\nCVSS 10.0 / EPSS 1% / KEV \u2705\nTL;DR: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files \u2026\nhttps://cvesentinel.com/report/CVE-2026-48939?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-07-10T18:18:56.671002Z"}, {"uuid": "a16f6222-bd3f-4cfa-b52a-289d73661f46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mqcww6zvhz2f", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48939 iCagenda Unrestricted Upload\u2026\n\n\ud83d\udd17 https://hnow.live/a/1160719f", "creation_timestamp": "2026-07-10T20:02:28.893487Z"}, {"uuid": "1c5306a1-1caa-4f7d-9b50-b86f614471cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6961009", "content": "2026-07-10: [CVE-2026-48939] iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityiCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\ncisakev", "creation_timestamp": "2026-07-10T21:00:25.313943Z"}, {"uuid": "e370c894-aca2-4d93-aff9-c4e1429c8503", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdek725kc2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/394E4504-A538-422A-9DE6-D5EC7D4CA278", "creation_timestamp": "2026-07-11T00:06:18.378442Z"}, {"uuid": "65fe6ad7-2a68-4026-ad8d-b165a28dead9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mstgcggtjs26", "content": "iCagenda\u3068Balbooa Forms\u306eJoomla\u306e\u8106\u5f31\u6027\u304c\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3068\u3057\u3066\u60aa\u7528\u3055\u308c\u305f\u3068\u306e\u5831\u9053\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u5b9f\u969b\u306b\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u884c\u308f\u308c\u305f\u3068\u306e\u5831\u544a\u3092\u53d7\u3051\u3001 Joomla\u306eiCagenda\u304a\u3088\u3073Balbooa\u62e1\u5f35\u6a5f\u80fd\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b2\u3064\u306e\u6700\u9ad8\u30ec\u30d9\u30eb\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\nCVSS\u30b9\u30b3\u30a2\u30ea\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306710.0\u3068\u8a55\u4fa1\u3055\u308c\u305f\u8106\u5f31\u6027\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002\n\nCVE-2026-48939 - Joomla \u7528 iCagenda \u62e1\u5f35\u6a5f\u80fd\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3002\u30d5\u30a1\u30a4\u30eb\u6dfb\u4ed8\u6a5f\u80fd\u3092...", "creation_timestamp": "2026-08-11T20:10:46.171940Z"}, {"uuid": "6aeaae95-3095-4bed-a781-4fb73d453c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdgjw633j2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48939 \u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 iCagenda \u0434\u043b\u044f Joomla: \u0443\u0433\u0440\u043e\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/A1AB5475-6F6B-416C-A06D-67A3D02545AD", "creation_timestamp": "2026-07-11T00:41:56.155499Z"}, {"uuid": "84d4af59-6abe-4846-93a1-8873f69daa27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/qiancx.bsky.social/post/3mqdgk5sbg326", "content": "Joomla iCagenda \u63d2\u4ef6\u6f0f\u6d1e CVE-2026-48939:\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u98ce\u9669\u4e0e\u5b89\u5168\u9632\u62a4\u6307\u5357\n\n\n\nhttps://qian.cx/posts/5DD651F3-1137-44AF-A3D0-A0FD2F28CEA2", "creation_timestamp": "2026-07-11T00:42:04.147611Z"}, {"uuid": "7d522890-0343-4303-8252-2d01cf761e3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116907369274600216", "content": "\ud83d\udcf0 CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog\n\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-joomla-icagenda-balbooa-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-07-12T14:01:28.613265Z"}, {"uuid": "dc656c8a-c364-425d-b3e2-7cd83342b734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqhdpsawu725", "content": "\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-12T14:02:12.055669Z"}, {"uuid": "7c51b982-5d79-44bb-aae8-94e7c2d87699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqj5wg6v462s", "content": "\ud83e\udd16 CVE-2026-48939 & CVE-2026-56291 (CVSS 10.0): Two Joomla extensions exploited as zero-days in the wild. Unauthenticated RCE via file upload. CISA KEV added.\nhttps://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "creation_timestamp": "2026-07-13T07:23:50.742722Z"}, {"uuid": "87dff641-3a17-4cf4-9177-743e485882b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfhw4p3627", "content": "CVE-2026-56291 and CVE-2026-48939: Joomla Extensions Expose Unpatched Risk #Joomla #Cybersecurity #Vulnerability", "creation_timestamp": "2026-07-13T09:38:54.191237Z"}, {"uuid": "bd5734e8-c0e2-466a-92ac-69dfab203c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfhxw7if2k", "content": "CVE-2026-56291 and CVE-2026-48939: Joomla Extensions Expose Untracked Risks #CyberSecurity #Vulnerabilities #Joomla", "creation_timestamp": "2026-07-13T09:38:56.499096Z"}, {"uuid": "fa3d19d9-6a59-4459-8f2d-b6b622618848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjfm3n2vp2f", "content": "CVE-2026-56291 and CVE-2026-48939: Urgency or Overreaction in Joomla's Security Response? #Joomla #CyberSecurity #VulnerabilityManagement", "creation_timestamp": "2026-07-13T09:41:14.735415Z"}, {"uuid": "95d80818-d334-412c-875c-ec17fc26b177", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild.\n\nThe vulnerabilities, both rated 10.0 on the CVSS scoring system, are below -\n\n\n  CVE-2026-48939 - A vulnerability in the", "creation_timestamp": "2026-07-13T10:00:54.425715Z"}, {"uuid": "8c80d245-24b1-404c-99ce-425aceb7003a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqjkw6a7ow2x", "content": "Rapid reaction gets you ahead. 10 days before CISA added CVE-2026-48939 a critical Remote Code Execution vulnerability in iCagenda extension for Joomla to KEV, watchTowr clients were aware of their exposure.\n\nReach o\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2076624767352799698)", "creation_timestamp": "2026-07-13T11:16:21.638307Z"}, {"uuid": "49d9496e-09ce-4584-8d76-14037e70c860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mqkmnbpmtc2n", "content": "Monday\u2019s fuck up - this Time - Joomla - \u200aCISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities. CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Actively Exploited!\nthecyberexpress.com/cisa-cve-202... #joomla #exploit #0day #CISA #cve-2026-48939 #cve-2026-56291 #iCagenda #Balbooa", "creation_timestamp": "2026-07-13T11:20:07.768487Z"}, {"uuid": "62cdebec-b4bd-41d2-9094-1d8da61a1af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mqjnevryg32s", "content": "Joomla extensions iCagenda and Balbooa Forms have KEV-listed zero-day flaws reportedly exploited in the wild (CVE-2026-48939, CVSS 10). Patch and audit sites for exposure. #Cybersecurity #Vulnerability #ZeroDay\n\nSource: https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "creation_timestamp": "2026-07-13T12:00:23.549188Z"}, {"uuid": "c9a14170-efbd-46c5-9a78-9572ac2d38f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://dnsc.ro/citeste/alerta-vulnerabilitati-exploatate-activ-in-joomla", "content": "", "creation_timestamp": "2026-07-13T12:15:11.100335Z"}, {"uuid": "af317c3a-2f9f-4fcd-a0a3-29d6be74e7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mqjplozg4p2v", "content": "U.S. CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48939 (iCagenda) and CVE-2026-56291 (Balbooa Forms). CVE-2026-48939, with a CVSS score of 10.0, allows arbitrary file uploads leading to PHP code execution.", "creation_timestamp": "2026-07-13T12:39:57.968334Z"}, {"uuid": "d1caae61-74ca-44d6-9176-7cc985c80ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbegj7q27", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla Extensions Are Under Siege #Joomla #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-13T15:33:09.576478Z"}, {"uuid": "8c6a9c59-2f8c-49df-b80d-2ca7ed4a1687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbgc4ui2h", "content": "CVE-2026-48939 and CVE-2026-56291 Expose Joomla Sites to RCE \u2014 Immediate Action Required #Joomla #CyberSecurity #RCE", "creation_timestamp": "2026-07-13T15:33:11.152529Z"}, {"uuid": "baa6453d-6cdf-4f74-9ed2-de794c7bde9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbicek42j", "content": "CVE-2026-48939: Joomla's Remote Code Execution Flaws Demand Immediate Attention #Joomla #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-13T15:33:13.543414Z"}, {"uuid": "c7f8050b-f003-4be0-81b3-a7c227f2fe78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzbkb6l322", "content": "CVE-2026-48939: CISA Urges Immediate Response to Joomla Flaws, But Will It Matter? #CVE2026 #JoomlaSecurity #Cybersecurity", "creation_timestamp": "2026-07-13T15:33:15.654282Z"}, {"uuid": "33b1713c-88bd-4ebe-a5ad-fa6f9622f7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqjzfhqffb2p", "content": "CVE-2026-48939: Exploit Development or Poor Vendor Responsibility? #CVE2026 #CyberSecurity #VendorResponsibility", "creation_timestamp": "2026-07-13T15:35:27.010527Z"}, {"uuid": "0b365aec-d639-4e00-a842-713c6fcfc05b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqkdz6s6c22d", "content": "CISA flags active RCE exploitation in Joomla extensions iCagenda and Balbooa Forms. Arbitrary file upload flaws in CVE-2026-48939 and CVE-2026-56291 can lead to full site compromise. #Joomla #iCagenda #BalbooaForms", "creation_timestamp": "2026-07-13T18:45:25.909321Z"}, {"uuid": "5de3f46f-7285-49d2-b2e2-75dd93fdc9a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116914226485690947", "content": "\ud83d\udcf0 CISA Adds Two Actively Exploited Joomla Plugin Flaws to KEV Catalog\n\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-joomla-icagenda-balbooa-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-07-13T19:05:21.641222Z"}, {"uuid": "0f0361e0-5b08-4ce0-8106-33692121702e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqkf637sbx2u", "content": "\ud83d\udce2 CISA KEV UPDATE: Two Joomla plugin vulnerabilities are now listed as actively exploited. CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) allow file uploads and server takeover. Patch immediately! #CISA #KEV #Joomla #Vulnerability\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-13T19:06:03.977973Z"}, {"uuid": "e906a2a7-b18b-4ad0-9439-4e92ee09e0c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:12.148385Z"}, {"uuid": "3e192268-57b6-4968-b984-67aaad45ab62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:17.249965Z"}, {"uuid": "39c74641-04a6-4f61-871d-318edeac53f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:20.353002Z"}, {"uuid": "804b8f38-e296-43f1-b11f-98020ee36f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.748343Z"}, {"uuid": "fc1c466f-99bb-4a47-aa75-cbf53d595b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild.\n\nThe vulnerabilities, both rated 10.0 on the CVSS scoring system, are below -\n\n\n  CVE-2026-48939 - A vulnerability in the", "creation_timestamp": "2026-07-14T01:00:43.112783Z"}, {"uuid": "8540525d-360a-4675-9527-649bc42c6d9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqli7q37zh2a", "content": "CISA warns of actively exploited RCE flaws in Joomla extensions (CVE-2026-48939 and CVE-2026-56291) #patchmanagement", "creation_timestamp": "2026-07-14T05:33:19.981646Z"}, {"uuid": "99d3f4a8-841a-4a57-82a3-890a75725fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48939", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqloi5uyei22", "content": "\ud83d\udcf0 CISA Peringatkan Celah Kritis pada Ekstensi Joomla yang Sedang Dieksploitasi untuk Serangan RCE\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/14/cisa-peringatkan-kerentanan-joomla-rce/\n\n#balbooaForms #cisa #cve-2026-48939 #cve-2026-56291 #cyberSecurity #icagenda #joomla #rce", "creation_timestamp": "2026-07-14T07:25:25.422934Z"}, {"uuid": "d60f521c-c648-4502-9052-66c18a208957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mqm3x766yk2r", "content": "Two Joomla extensions hit maximum severity. CISA confirms they're being exploited as zero-days.\n\nCVE-2026-48939.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-56291-balbooa-forms-unauthenticated-rce-exploited/\n\n#InfoSec #ThreatIntel", "creation_timestamp": "2026-07-14T11:26:28.551369Z"}, {"uuid": "950979ac-1e4a-4fb7-bf74-3ec3d54d17d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6hx5gaj2k", "content": "CVE-2026-48939: Joomla Extensions\u2019 Perfect 10 Scores Are a Cyber Crisis #Cybersecurity #Joomla #CVE2026", "creation_timestamp": "2026-07-14T12:11:38.540719Z"}, {"uuid": "75510b22-d650-4877-b861-90a54bfba8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6i2mdqu2g", "content": "CVE-2026-48939: Attackers Leverage Critical Joomla Extensions Flaws for RCE #CVE202648939 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:41.921644Z"}, {"uuid": "0aa56b04-2e95-4ed0-8cac-8575413b2dde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6i637wp2p", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla\u2019s Exploitation Exposes Security Gaps Amid Inaction #Joomla #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-14T12:11:45.724036Z"}, {"uuid": "abe1354d-b265-47a9-95cf-4c9f86646784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6iced2d26", "content": "CVE-2026-48939 and CVE-2026-56291: Joomla Extensions Fail to Protect Users #CVE2026 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:50.511885Z"}, {"uuid": "d4eac64f-a199-443a-b0d0-b32c66599acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6ifkonh2f", "content": "CVE-2026-48939: Joomla's Perfect 10 Vulnerabilities Show Attribution Gaps #CVE202648939 #Joomla #CyberSecurity", "creation_timestamp": "2026-07-14T12:11:53.337201Z"}, {"uuid": "65d24a71-360e-408e-805a-96b65518f25d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqm6ijcdoa2o", "content": "CVE-2026-48939 and CVE-2026-56291: Are Joomla Patches Enough? #Joomla #Cybersecurity #Vulnerabilities", "creation_timestamp": "2026-07-14T12:11:57.537060Z"}, {"uuid": "febfee6a-0c45-4e1c-a528-5f77465bd15f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 20:57:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.899026Z"}, {"uuid": "5411a266-f772-46c7-bc26-9c2cf02d7258", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-..CVE-2026-48939\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-29 11:11:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda Unauthenticated File Upload to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:24.063656Z"}, {"uuid": "e1af6c53-cdbd-4345-9bf6-c1f9750dc13a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://gist.github.com/alon710/1e41cbc3b54c1c25a3d44fc7a523b70b", "content": "# CVE-2026-48939: CVE-2026-48939: Unauthenticated Remote Code Execution in Joomla iCagenda Extension\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-06-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48939\n\n## Summary\nCVE-2026-48939 is a critical vulnerability in the iCagenda events calendar extension for Joomla that allows unauthenticated remote attackers to execute arbitrary code via unrestricted file uploads. The flaw stems from a lack of server-side validation of file uploads and missing authorization checks at the controller level. Successful exploitation results in complete compromise of the affected web application host.\n\n## TL;DR\nUnauthenticated arbitrary file upload in iCagenda allows remote code execution via direct POST requests to controller endpoints.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-434, CWE-284\n- **Attack Vector**: Network\n- **CVSS Score**: 10.0 (Critical)\n- **Exploit Status**: Active exploitation in the wild\n- **CISA KEV Status**: Listed on July 10, 2026\n\n## Affected Systems\n\n- Joomla instances running iCagenda 3.2.1 through 3.9.14\n- Joomla instances running iCagenda 4.0.0 through 4.0.7\n- **iCagenda**: >= 3.2.1, < 3.9.15 (Fixed in: `3.9.15`)\n- **iCagenda**: >= 4.0.0, < 4.0.8 (Fixed in: `4.0.8`)\n\n## Mitigation\n\n- Upgrade iCagenda extension to version 4.0.8 (for Joomla 4.x/5.x/6.x) or 3.9.15 (for legacy Joomla 3.x)\n- Configure web server rules to deny script execution inside the /images/ directory\n- Temporarily rename or delete the com_icagenda directories if patching is delayed\n\n**Remediation Steps:**\n1. Navigate to Joomla administrator panel and check the version of the iCagenda component.\n2. Download the patched package (4.0.8 or 3.9.15) from the official iCagenda website.\n3. Install the update via the Joomla Extension Manager to replace vulnerable files.\n4. Verify the directory /images/icagenda/frontend/attachments/ for any suspicious PHP files.\n5. Implement server-level execution blockings using Apache .htaccess or Nginx configuration blocks.\n\n## References\n\n- [mySites.guru Zero-Day Advisory](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939)\n- [National Vulnerability Database (NVD) CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)\n- [CVE Org Authority Entry](https://www.cve.org/CVERecord?id=CVE-2026-48939)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48939) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-16T07:01:40.210426Z"}, {"uuid": "3302eab6-fd56-48e3-9100-dfc0393158ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-16T19:00:27.522934Z"}, {"uuid": "cd3d4b77-bbde-4be8-b6b2-265dafaf65af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-16T19:00:27.632423Z"}, {"uuid": "b3f9023e-99df-404d-9734-d8cd8b8b5635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-17T00:00:44.303009Z"}, {"uuid": "a47e6b95-0647-4324-9b85-ab2e4aa405e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-17T00:00:44.425414Z"}, {"uuid": "368f8f57-4367-45b1-99a4-7a0e940f61e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-18T01:00:03.946939Z"}, {"uuid": "6141346e-3a66-4083-9bde-2e0e738e830a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-18T01:00:04.104774Z"}, {"uuid": "742fa4b2-3517-40b4-bd05-b064dfe023ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/ibPzm16gF0sjZFLJaVULBcK_v0_qnzuuiiBsudPYi66KUg", "content": "", "creation_timestamp": "2026-07-18T13:00:03.996269Z"}, {"uuid": "8b12a735-92a5-42aa-9d17-ee35ba87a182", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94050", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 22:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T23:00:03.529274Z"}, {"uuid": "bfa2c63b-7882-4542-8116-0712ead832f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94050", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48939_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 22:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\niCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.096591Z"}, {"uuid": "efaab5f4-6387-49c1-9bcb-be2b6c3f7978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "exploited", "source": "Telegram/ibPzm16gF0sjZFLJaVULBcK_v0_qnzuuiiBsudPYi66KUg", "content": "", "creation_timestamp": "2026-07-19T00:00:28.017771Z"}, {"uuid": "df60e1d5-78c2-4b86-9e86-98e78e912aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-19T00:00:41.609645Z"}, {"uuid": "c7421b8b-e01a-4594-b72b-7aa7be649dc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/wihZfhaQT2qHw0wLZ8sk5tSU7nS9hHHdvUYjPR1ZKZ5oBq0", "content": "", "creation_timestamp": "2026-07-19T00:00:41.785712Z"}, {"uuid": "af028700-5972-45e1-a183-53e1b3b14392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-20T18:00:05.301013Z"}, {"uuid": "33ec86a5-4e58-4f6d-8bae-9b01c7846466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "https://t.me/pphm_HackerNews/1987", "content": "\ud83d\udd34 Two Critical Joomla Flaws Exploited as Zero-Days\n\nCISA has added two maximum-severity vulnerabilities to its Known Exploited \n\nVulnerabilities catalog:\n\n\u26a0\ufe0f CVE-2026-48939: iCagenda arbitrary file upload\n\n\u26a0\ufe0f CVE-2026-56291: Balbooa Forms unauthenticated remote code execution\n\nBoth flaws carry a CVSS score of 10.0\n\nAttackers can upload malicious PHP files and deploy web shells", "creation_timestamp": "2026-08-23T00:00:43.602268Z"}, {"uuid": "7ade06d4-6c9a-4818-8368-c0ae1448b72a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-21T00:00:32.276435Z"}, {"uuid": "892bd71f-ecf2-4027-905f-395393e99a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48939", "type": "published-proof-of-concept", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-22T00:00:07.964446Z"}]}