# Newly exploited vulnerabilities: week of 6 to 12 July 2026 (week 28)

Source: https://junglewise.ai/threats/exploited/2026-07-06  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-07-06.json  
License: CC BY 4.0 with a link back

In the week of 6 to 12 July 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Adobe ColdFusion (1), followed by Icagenda.com iCagenda (1) and Joomlack Page Builder (1).

## Newly exploited this week

- [CVE-2026-56291: Balbooa Forms for Joomla unauthenticated file upload RCE](https://junglewise.ai/threats/cve-2026-56291-balbooa-forms-for-joomla-unauthenticated-file-upload-rce) (critical, exploited in the wild, CVSS 10, exploited since 10 Jul 2026, published 9 Jul 2026)
- [CVE-2026-48939: Joomla iCagenda arbitrary file upload in file attachment feature](https://junglewise.ai/threats/cve-2026-48939-joomla-icagenda-arbitrary-file-upload-in-file-attachment-feature) (critical, exploited in the wild, CVSS 10, exploited since 10 Jul 2026, published 20 Jun 2026)
- [CVE-2026-48282: Adobe ColdFusion path traversal in multiple versions](https://junglewise.ai/threats/cve-2026-48282-adobe-coldfusion-path-traversal-in-multiple-versions) (critical, exploited in the wild, CVSS 10, exploited since 7 Jul 2026, published 30 Jun 2026)
- [CVE-2026-56290: Joomlack Page Builder CK unauthenticated arbitrary file upload](https://junglewise.ai/threats/cve-2026-56290-joomlack-page-builder-ck-unauthenticated-arbitrary-file-upload) (critical, exploited in the wild, CVSS 10, exploited since 7 Jul 2026, published 29 Jun 2026)
- [CVE-2026-55255: Langflow IDOR in responses endpoint allows cross-user flow execution](https://junglewise.ai/threats/cve-2026-55255-langflow-idor-in-responses-endpoint-allows-cross-user-flow) (critical, exploited in the wild, CVSS 9.9, exploited since 7 Jul 2026, published 23 Jun 2026)
- [CVE-2026-48908: JoomShaper SP Page Builder arbitrary file upload in Joomla](https://junglewise.ai/threats/cve-2026-48908-joomshaper-sp-page-builder-arbitrary-file-upload-in-joomla) (critical, exploited in the wild, CVSS 10, exploited since 7 Jul 2026, published 20 Jun 2026)

## Technologies hit most

1. [Adobe ColdFusion](https://junglewise.ai/threats/technologies/coldfusion): 1 vulnerability
2. [Icagenda.com iCagenda](https://junglewise.ai/threats/technologies/icagenda): 1 vulnerability
3. Joomlack Page Builder: 1 vulnerability
4. Joomlack.fr Page Builder CK: 1 vulnerability
5. [JoomShaper SP Page Builder](https://junglewise.ai/threats/technologies/sp-page-builder): 1 vulnerability
6. [Langflow](https://junglewise.ai/threats/technologies/langflow): 1 vulnerability
7. [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 6 to 12 July 2026 (week 28)", https://junglewise.ai/threats/exploited/2026-07-06, 2 October 2026.