🕵️ RESEARCH & DEEP DIVES
Joomla SP Property extension vulnerable to unauthenticated stored XSS (CVE-2026-78302)
The Joomla SP Property extension before 4.1.4 has an unauthenticated stored XSS vulnerability via unescaped output.- Affects the SP Property extension (joomshaper.com) for Joomla, versions 1.0.0 through 4.1.3; fixed in 4.1.4.
- Unauthenticated stored cross-site scripting (CWE-79), rated HIGH 8.6 CVSS 4.0.
- Multiple template files in frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping.
- CVE-2026-78302, assigned by Joomla, published 2026-09-10.
Critical NetScaler Vulnerability Exploited in Attacks — SecurityWeek
Widened Scan Turns Up Fourth Rogue Claude Cyber Incident — SecurityWeek
4.1 Million Impacted by AdaptHealth Data Breach — SecurityWeek
Microsoft says September updates fix mouse settings reset issues — BleepingComputer
AIs Compress Exploit Timeline — Schneier on Security
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline — The Hacker News
Evolution: evolution: javascript execution via spoofed vcard control bypasses... — CVE ThreatInt
Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth ... — CVE ThreatInt
t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in M... — CVE ThreatInt
ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed... — CVE ThreatInt
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Managemen... — CVE ThreatInt
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint i... — CVE ThreatInt
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Proper... — CVE ThreatInt
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image M... — CVE ThreatInt
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property... — CVE ThreatInt
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Mani... — CVE ThreatInt
An authorization bypass vulnerability exists in the Countly Server DBViewer d... — CVE ThreatInt
Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks — Cyber Security News
LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials — Cyber Security News
Hackers Pose as Domain Controllers to Steal Active Directory Password Hashes — Cyber Security News
CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks — Cyber Security News
OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography — Cyber Security News
Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User — Cyber Security News
OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities — Cyber Security News
The CVE spike across major software companies is a remediation problem — aikido.dev (discovered)
How the Best Web Content Filtering Software Helps Schools Manage AI Tools Safely — securityboulevard.com (discovered)
Two chicken nuggets and a Claude account — securityboulevard.com (discovered)
MSP New Client Onboarding Checklist for DMARC Implementation — securityboulevard.com (discovered)