Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-76596 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table | 23 Oct |
| CVE-2026-76597 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot. | 23 Oct |
| CVE-2026-76598 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings. | 23 Oct |
| CVE-2026-76599 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables method of the elements model allows listings of arbitrary database tables including columns. | 23 Oct |
| CVE-2026-67359 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals. | 14 Oct |
| CVE-2026-102775 | 8.7 high | 0.00% | phoca, phoca_cart | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens. | 14 Oct |
| CVE-2026-102784 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request. | 8 Oct |
| CVE-2026-102790 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16 | Wed 28 Oct |
| CVE-2026-23898 | 8.6 high | 0.00% | joomla, joomla\! | Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. | Mon 26 Oct |
| CVE-2026-23899 | 8.6 high | 0.00% | joomla, joomla\! | An improper access check allows unauthorized access to webservice endpoints. | Mon 26 Oct |
| CVE-2026-60028 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG. | Sat 24 Oct |
| CVE-2026-57833 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature. | 23 Oct |
| CVE-2026-77027 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector. | 23 Oct |
| CVE-2026-76612 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector. | 23 Oct |
| CVE-2026-102786 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | 23 Oct |
| CVE-2026-76613 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries. | 15 Oct |
| CVE-2026-100750 | 8.5 high | 0.00% | regularlabs, modules_anywhere | Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs. | Tue 27 Oct |
| CVE-2026-71574 | 8.5 high | 0.00% | joomla, joomla\! | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | 22 Oct |
| CVE-2026-65878 | 8.3 high | 0.00% | no CPE yet | Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager. | Sat 24 Oct |
| CVE-2026-94131 | 8.3 high | 0.00% | acymailing | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php. | 20 Oct |
| CVE-2026-97162 | 8.3 high | 0.00% | lomart, up | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 20 Oct |
| CVE-2026-65758 | 8.2 high | 0.00% | no CPE yet | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions. | Sat 24 Oct |
| CVE-2026-65877 | 8.2 high | 0.00% | no CPE yet | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector. | Sat 24 Oct |
| CVE-2026-73337 | 8.2 high | 0.00% | joomla, joomla\! | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 22 Oct |
| CVE-2026-65757 | 8.1 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens. | Sat 24 Oct |
| CVE-2026-63265 | 8.0 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. | Sat 24 Oct |
| CVE-2026-100751 | 7.5 high | 0.00% | regularlabs, tabs_\&_accordions | Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open() when the item is activated. Affected versions do not reject browser URL schemes which execute JavaScript. Joomla sees ordinary plugin syntax while filtering the authored article; Tabs & Accordions creates the executable browser behavior later while rendering the article. | Tue 27 Oct |
| CVE-2026-63047 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information. | Sat 24 Oct |
| CVE-2026-63683 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules. | Sat 24 Oct |
| CVE-2026-64792 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors. | Sat 24 Oct |
| CVE-2026-64797 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts. | Sat 24 Oct |
| CVE-2026-64799 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder. | Sat 24 Oct |
| CVE-2026-65430 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. | Sat 24 Oct |
| CVE-2026-65755 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable. | Sat 24 Oct |
| CVE-2026-65881 | 7.5 high | 0.00% | no CPE yet | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts. | Sat 24 Oct |
| CVE-2026-65943 | 7.5 high | 0.00% | rolandd, ro_csvi | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0 | 23 Oct |
| CVE-2026-65947 | 7.3 high | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 | 23 Oct |
| CVE-2026-97164 | 7.0 high | 0.00% | svenbluege, event_gallery | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.process` task, you can recursively delete any directories that the web server is authorized to write to. | Tue 27 Oct |
| CVE-2026-75115 | 7.0 high | 0.00% | no CPE yet | Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files. | 15 Oct |
| CVE-2026-21630 | 6.9 medium | 0.00% | joomla, joomla\! | Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. | Mon 26 Oct |
| CVE-2026-60031 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses. | Sat 24 Oct |
| CVE-2026-65765 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities. | Sat 24 Oct |
| CVE-2026-76601 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. | 23 Oct |
| CVE-2026-76600 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform any access checks. | 23 Oct |
| CVE-2026-76603 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users. | 23 Oct |
| CVE-2026-76608 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 - The onGetEmail endpoint did not perform any access checks. | 23 Oct |
| CVE-2026-76609 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. | 23 Oct |
| CVE-2026-76611 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66. | 23 Oct |
| CVE-2026-67283 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension. | 23 Oct |
| CVE-2026-71573 | 6.9 medium | 0.00% | joomla, joomla\! | Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. | 22 Oct |
Download these 219 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.