Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-29 | 2 | Disclosure2 |
| 2026-06-03 | 1 | Disclosure1 |
⚠️ Vulnerabilidades en productos Joomla ❗ CVE-2026-48904 ❗ CVE-2026-48902 ❗ CVE-2026-35223 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-joomla-2/ https://t.co/Bbf1vJ9IzF
Post summary
Three Joomla product CVEs (CVE-2026-48904, CVE-2026-48902, CVE-2026-35223) are referenced with a link for more details, but the post lacks PoC, exploit code, active exploitation claims, or technical mitigation information.
Critical 9.8 in Joomla! Core (CVE-2026-48902): password/username reset links silently downgrade to plain HTTP unless "Force SSL" is set — exposing credentials in transit. Check your Joomla config now. #Joomla #infosec https://secalerts.co/vulnerability/CVE-2026-48902 https://t.co/IobDrDcqof
Post summary
The tweet announces a critical Joomla core vulnerability (CVE-2026-48902) that downgrades reset links from HTTPS to HTTP, exposing credentials, and recommends enabling Force SSL as a workaround.
🔴 Joomla, Transport Encryption Downgrade, #CVE-2026-48902 (Critical) -DC-May2026-40 https://dailycve.com/joomla-transport-encryption-downgrade-cve-2026-48902-critical-dc-may2026-40/
Post summary
The content announces the discovery of a new critical Joomla vulnerability, CVE‑2026‑48902, but provides no further technical or threat details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | joomla | joomla\! | - | - | - |