CVE-2026-63280

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-632814.8Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/CVE-2026-63296.5PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched M CVE-2026-632927.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a rem CVE-2026-632939.9A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When import CVE-2026-632949.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpackin CVE-2026-632954.3An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When CVE-2026-632969.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migratio CVE-2026-632979.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass ta CVE-2026-632989.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacke CVE-2026-632999.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code p CVE-2026-63306.5The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection an CVE-2026-633009.9An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker w