VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side…
Excerpt from the primary source: CERT/CC Vulnerability Notes
Who is affected
Developers
What you should do · Review
Review whether your organization uses the affected products and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Government advisory
Related
Microsoft: Windows 11 23H2 reaches end of support in 30 days
Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month.
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Apply the vendor's security update for SonicWall firewalls & SMA.
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.
Source reporting says attackers are already exploiting this, so exposed affected systems are at immediate risk.
No complete fix is indicated yet.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.
Source reporting says attackers are already exploiting this, so exposed Microsoft Edge systems are at immediate risk.
Treat this as an emergency.