SecurityThe Hacker Newsabout 3 hours ago
Two Joomla Flaws Exploited as Zero-Days
1 min read
CISA added two maximum-severity Joomla extension flaws to its KEV catalog after zero-day exploitation. CVE-2026-48939 in iCagenda and CVE-2026-56291 in Balbooa Forms both allow unauthenticated remote code execution. Patches are available in iCagenda 4.0.8/3.9.15 and Balbooa Forms 2.4.1. FCEB agencies must fix by July 13, 2026.
Level
Hype check
Tap to vote and see what everyone thinks.
