VulncastBriefing archive

Daily Brief - 2026-07-12

· 4 vulnerabilities · 6 min listen

▶ Listen to this briefing

CVE-2026-57827

Joomla RSFiles

The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

  • Remote Code Execution
  • php
  • web application

CVE-2026-58281

high · CVSS 8.3 · Microsoft Edge

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  • Insecure Deserialization
  • Remote Code Execution
  • web browser

CVE-2026-61447

critical · CVSS 10 · PraisonAI

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

  • Remote Code Execution
  • ai agent framework

CVE-2026-61465

low · CVSS 3.3 · ImageMagick

ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.

  • Denial of Service
  • image processing library