https://cvebrief.com/archive/cves/vendor/regularlabs-com/ High and critical regularlabs.com vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Mon, 14 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-85189/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-85189 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-85190/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-85190 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 - Quick Index inserts configurable class values into generated HTML without escaping them for an HTML attribute. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-85191/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-85191 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-85192/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-85192 Mon, 14 Sep 2026 12:00:00 GMT A code injection vulnerability in the Conditional Content Pro extension allows authenticated, privileged users to execute arbitrary PHP code on the server via malicious article syntax. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-85195/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-85195 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88852/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-88852 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 - Snippets substitutes variable values supplied by an article tag into saved Snippet content. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88853/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-88853 Mon, 14 Sep 2026 12:00:00 GMT Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-74253/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-74253 Tue, 18 Aug 2026 12:00:00 GMT The Regular Labs Sourcerer extension for Joomla is vulnerable to unauthenticated remote code execution due to improper handling of reflected user input within rendered HTML blocks. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64792/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64792 Sat, 15 Aug 2026 12:00:00 GMT Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-63684/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-63684 Fri, 14 Aug 2026 12:00:00 GMT Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64791/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64791 Fri, 14 Aug 2026 12:00:00 GMT Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64798/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64798 Fri, 14 Aug 2026 12:00:00 GMT Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64793/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64793 Thu, 13 Aug 2026 12:00:00 GMT Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64796/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64796 Thu, 13 Aug 2026 12:00:00 GMT Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-64873/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-64873 Mon, 03 Aug 2026 12:00:00 GMT Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65430/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-65430 Sun, 02 Aug 2026 12:00:00 GMT Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65431/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-65431 Sun, 02 Aug 2026 12:00:00 GMT A path traversal vulnerability in the Regular Labs GeoIP extension for Joomla allows for arbitrary file writes during the extraction of database update archives. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-63683/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-63683 Sat, 01 Aug 2026 12:00:00 GMT IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-65757/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-regularlabs-com-CVE-2026-65757 Sat, 25 Jul 2026 12:00:00 GMT Joomla Extension - regularlabs Independent analyst report on CVE Brief.