Vulnerability Management CISA adds iCagenda and Balbooa Forms vulnerabilities to known exploited catalog July 13, 2026 Share By SC Staff As reported by Security Affairs, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting Joomla extensions, iCagenda and Balbooa Forms, to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion mandates federal agencies to address these flaws by July 13, 2026. The vulnerabilities, CVE-2026-48939 affecting iCagenda and CVE-2026-56291 affecting Balbooa Forms, both allow for unrestricted file uploads. Specifically, attackers can exploit these flaws to upload dangerous file types, including PHP code, leading to remote code execution (RCE). iCagenda is an open-source event management extension for Joomla, while Balbooa Forms is a commercial form builder. The high severity of these vulnerabilities, with CVE-2026-48939 having a CVSS score of 10.0, poses a significant risk to websites utilizing these extensions. CISA's Binding Operational Directive 22-01 requires federal agencies to remediate these vulnerabilities to prevent exploitation. Private organizations are also strongly advised to review the KEV catalog and patch their systems accordingly. Source: Security Affairs SC Staff Related Vulnerability Management Six U-Boot vulnerabilities could allow stealthy firmware attacks SC Staff July 13, 2026 The vulnerabilities, found in U-Boot's FIT signature verification code, range from denial of service to arbitrary code execution. Vulnerability Management Researcher finds 9 vulnerabilities in ATM security software SC Staff July 10, 2026 Matt Burch, a principal security researcher at Atredis Partners, will present his findings on CryptoPro Secure Disk at Black Hat USA 2026. Vulnerability Management Zimbra urges patching of critical XSS vulnerability in Classic Web Client SC Staff July 10, 2026 The vulnerability, which currently lacks a CVE ID, impacts the Classic Web Client interface of the Zimbra Collaboration suite, used by millions globally, including businesses and government agencies. Related Events Cybercast Why Mythos is the cybersecurity crisis we need Wed Jul 22 Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds