https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:42:54.747027+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-357564 EUVD-2026-357564 2026-10-06T09:42:54.793627+00:00 EUVD-2026-357564 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67361 fkie_cve-2026-67361 2026-10-06T09:42:54.793665+00:00

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

 https://cve.radiocsirt.org/vuln/ghsa-2vmq-jqv2-9gfv GHSA-2vmq-jqv2-9gfv 2026-10-06T09:42:54.793700+00:00

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.