CVE-2026-21627

CriticalCVSS 9.5/10Last modified Jun 17, 2026

Description

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Metrics

CVSS 4.0 9.5/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-216289.8A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execut CVE-2026-216297.3The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected b CVE-2026-21637.2A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipul CVE-2026-216308.8Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-216315.4Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-216325.4Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-216338.8A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p CVE-2026-216346.5A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery pr CVE-2026-216356.5An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink fea CVE-2026-2163610.0A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabl CVE-2026-216377.5A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallba CVE-2026-216388.8A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote