Vulnerability intelligence
CVE-2026-56290
Joomla Extension joomlack.fr Unauthenticated file upload in Page Builder CK extension < 3.6.0 The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
CVSS Score
10
Critical
EPSS — Exploit Probability
83%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
KEV since 2026-07-07
Remediation
Patch available
Federal deadline 2026-07-10
10 articles across 5 outlets · first covered Jul 7, 2026 · latest Jul 9, 2026
Coverage timeline
-
LineageOS Browser Flash Tool Makes ROM Install Easiersecurityonline.info · Jul 9, 2026
-
Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yetsecurityonline.info · Jul 8, 2026
-
Foxit PDF Reader flaws expose users to arbitrary code executionsecurityonline.info · Jul 8, 2026
-
CISA alerts on critical ColdFusion Langflow and Joomla flawswww.securityweek.com · Jul 8, 2026
-
Android Remote Root Exploit Chain Unveiled by Nebulasecurityonline.info · Jul 8, 2026
-
CISA warns of active exploits in ColdFusion, Joomla page builderssecurityaffairs.com · Jul 8, 2026
-
Four flaws hit Joomla, Langflow, ColdFusion and Linux todaysecurityonline.info · Jul 8, 2026
-
CISA flags critical Joomla, ColdFusion bugs under attacksecurityonline.info · Jul 8, 2026
-
CISA Flags Joomlack Page Builder RCE Flaw (CVE-2026-56290) in KEVwww.cisa.gov · Jul 7, 2026
-
CISA flags Joomlack Page Builder flaw in KEV, July 10, neededcisa.gov · Jul 7, 2026