CVE-2026-48907: CRITICAL (CVSS 9.8), Actively Exploited (CISA KEV)

CRITICAL (CVSS 9.8), Actively Exploited (CISA KEV), EPSS 80.4%. A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.