New CVE: CVE-2026-102802 — joomla! (HIGH, 8.9)
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article… [HIGH]
https://nvd.nist.gov/vuln/detail/CVE-2026-102802