U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog


U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog

Pierluigi Paganini
July 11, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The flaws added to the catalog are:

  • CVE-2026-48939 (CVSS score of 10.0) iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
  • CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda is an open-source event management extension for Joomla. It allows website administrators to create, organize, and display events on Joomla-powered websites without custom development.

The vulnerability CVE-2026-48939 allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

The second flaw added to the catalog, tracked as CVE-2026-56291, is an unauthenticated arbitrary file upload in Balbooa Forms that allows uploading executable files and leads to full RCE.

Balbooa Forms is a commercial form builder extension for Joomla that lets administrators create advanced web forms without coding.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to urgently fix the vulnerabilities by July 13, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews



TL;DR

Bezos’s Prometheus raised $12B at a $41B valuation from JPMorgan, Goldman Sachs, and BlackRock. It builds AI for engineering physical products with 150 employees.

Prometheus, the AI startup co-led by Jeff Bezos, has raised $12 billion in a funding round that values the company at $41 billion. Investors include JPMorgan Chase, Goldman Sachs, BlackRock, DST Global, and Arch Venture Partners, alongside Bezos himself. Total funding now exceeds $18 billion.

The company is building what Bezos calls an “artificial general engineer,” AI tools designed to accelerate the process from design to manufacturing for physical products. Target industries include computing, aerospace, automotive, advanced manufacturing, and drug discovery. Prometheus currently has about 150 employees.

Bezos co-leads the company with Vik Bajaj, a Stanford medical school professor who previously co-founded Alphabet’s Verily health research lab. Bezos started as a founding investor in late 2024 but became so involved he took an operational role. “I became so impressed by what was happening and the potential that I decided I couldn’t sit on the sidelines and I needed to jump in with both feet,” he told CNBC.

This is Bezos’s first operational role in a technology company since stepping down as Amazon CEO in 2021. Prometheus launched in November 2025 with $6.2 billion in initial funding. The earlier reporting valued the round at $38 billion. The final close came in at $41 billion, a 7.9% markup from the figure reported in April.

The company’s pitch is “physical AI,” models trained on real-world experimental data, robotics interactions, and engineering workflows rather than just text and images. Where most AI companies focus on language or code, Prometheus is targeting the hard science of making things, from bridges to chips. The approach is designed to understand the laws of physics, not just patterns in data.

Prometheus has also sought to raise tens of billions more for a holding company that plans to acquire firms it sees as benefiting from the technologies the lab is developing. That would make it not just a startup but a conglomerate, one that develops the AI and then buys the companies that use it.

Bezos’s broader AI portfolio now spans robotics firms Physical Intelligence and Nvidia-backed Generalist AI, plus his continuing role as Amazon’s executive chair. With Prometheus, he is betting that AI’s biggest value is not in chatbots or code generation but in accelerating the engineering of physical objects, the domain where the physical AI race is attracting its largest cheques.



Source link