Critical CVSS 10.0 Vulnerabilities in Joomla SP Page Builder and Page Builder CK Enable One-Click Unauthenticated File Upload and Full Site Takeover
U.S. cybersecurity authorities have issued an urgent alert regarding three actively exploited vulnerabilities affecting Joomla extensions and the Langflow AI development platform. The Cybersecurity and Infrastructure Security Agency (CISA) has added the flaws to its Known Exploited Vulnerabilities (KEV) catalog and strongly recommends that organizations apply patches without delay.
The first vulnerability, CVE-2026-48908 (CVSS 10.0 Critical), resides in the SP Page Builder extension for Joomla. It allows an unauthenticated attacker to upload arbitrary files, including malicious PHP code, to the server and subsequently execute them, resulting in full control over the affected website.
The second issue, CVE-2026-55255 (CVSS 9.9 Critical), affects the Langflow platform used to build AI-powered applications. Due to improper authorization checks, an authenticated attacker can specify another user’s process identifier and execute it under that user’s privileges, potentially exposing confidential data, cryptographic keys, and other secrets stored within the system.
The third vulnerability, CVE-2026-56290 (CVSS 10.0 Critical), was discovered in the Page Builder CK extension for Joomla. Insufficient access controls enable unauthenticated attackers to upload and execute arbitrary code on the server, again granting complete site takeover capabilities.
All three vulnerabilities are already being leveraged in real-world attacks. Although CISA has not disclosed details about the threat actors, their targets, or the number of compromised systems, such flaws are frequently used as initial access vectors, especially when internet-facing websites and services are involved.
Federal civilian agencies are required to remediate these issues promptly under Binding Operational Directive (BOD) 26-04, which mandates rapid patching of KEV-listed vulnerabilities that affect publicly accessible resources and enable full system compromise. Agencies must also verify whether attackers have already gained access to their infrastructure before applying updates.
While the directive applies only to U.S. federal agencies, CISA recommends that all organizations adopt the same approach: identify vulnerable Joomla extensions and Langflow instances, deploy available patches, and thoroughly review system logs for signs of prior compromise.
Related articles
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.
CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.