NewsThe Hacker News2026-07-13 05:36 UTCSME Public Sector

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026-48939 - A vulnerability in the

Other advisories

CVE-2026-75948none
Joomla-Erweiterung - icagenda.
CVE-2026-67366none
Erweiterung für Joomla - icagenda.
CVE-2026-71570none
Erweiterung für Joomla - icagenda.
CVE-2026-71571none
Erweiterung für Joomla - icagenda.
CVE-2026-67365none
Joomla-Erweiterung - icagenda.
CVE-2026-48939critical
joomlic icagenda: uneingeschraenkter Dateiupload
CVE-2026-48939critical
joomlic icagenda: uneingeschraenkter Dateiupload

Other news entries

Newstheregister-security2026-07-14
Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites
Newsbleepingcomputer2026-07-13
CISA warns of actively exploited RCE flaws in Joomla extensions
Newssecurityweek2026-07-13
Organizations Warned of Exploited Joomla Extension Vulnerabilities

Source: https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html

More on iCagenda