NVD disclosure day

Published threat advisories for June 28, 2026

CVE-2026-49048

Joomla JoomCCK SQL Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

The JoomCCK extension for Joomla has a critical SQL injection vulnerability. If reachable, attackers can execute arbitrary SQL commands by concatenating user-supplied data into SQL queries, potentially leading to unauthorized access, modification, or theft of sensitive data. This impacts Joomla installations using the

NVD published: June 28, 2026

CVE advisoryCRITICAL

CVE-2026-58053

Gitea Act Runner Container Escape via Workflow Options

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A critical vulnerability in Gitea's act_runner allows a workflow user to escape its container and gain root access on the host system, even if privileged mode is disabled. This occurs because the runner incorrectly processes container options, enabling the creation of a job container with broad host capabilities. This

NVD published: June 28, 2026