CVE WatchNov 2, 2026

CVE-2026-102801

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-200

EPSS · 30d

Not enough EPSS history yet.

Technical description

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.

Official references

www.regularlabs.comhttps://www.regularlabs.com/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-136475.8 MED

—

——0The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.4h CVE-2026-1011786.6 MED

—

——0Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.4h CVE-2026-1011815.5 MED

—

——0Permission control vulnerability in the WLAN module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.4h CVE-2026-1203103.1 LOW

—

——0Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.17h CVE-2026-1203234.3 MED

—

——0A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.5h CVE-2026-1202335.3 MED

—

——0A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.4h