Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-100748 | 6.9 medium | 0.00% | svenbluege, event_gallery | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 | 20 Oct |
| CVE-2026-102779 | 6.9 medium | 0.00% | techfry, tf_content | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately. | 16 Oct |
| CVE-2026-102780 | 6.9 medium | 0.00% | techfry, tf_content | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`. | 14 Oct |
| CVE-2026-48943 | 6.5 medium | 0.00% | joomlaworks, k2 | K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form. | Sun 25 Oct |
| CVE-2026-64794 | 6.5 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details. | Sat 24 Oct |
| CVE-2026-64872 | 6.5 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. | Sat 24 Oct |
| CVE-2026-64875 | 6.5 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass. | Sat 24 Oct |
| CVE-2026-65713 | 6.5 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories. | Sat 24 Oct |
| CVE-2026-48947 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows privileged users to overwrite media files without editing permissions. | Sun 25 Oct |
| CVE-2026-48948 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | Sun 25 Oct |
| CVE-2026-48955 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows unauthorized users to access workflow stage and transition information. | Sun 25 Oct |
| CVE-2026-48956 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows users to display a list of modules in the frontend. | Sun 25 Oct |
| CVE-2026-48957 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows unauthorized users to access com_privacy datasets. | Sun 25 Oct |
| CVE-2026-48958 | 6.4 medium | 0.00% | joomla, joomla\! | An improper access check allows unauthorized users to create custom fields via webservices endpoints. | Sun 25 Oct |
| CVE-2026-21629 | 6.3 medium | 0.00% | joomla, joomla\! | The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers. | Mon 26 Oct |
| CVE-2026-67287 | 6.3 medium | 0.00% | no CPE yet | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input. | 23 Oct |
| CVE-2026-67360 | 6.3 medium | 0.00% | no CPE yet | Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked. | 14 Oct |
| CVE-2026-102777 | 6.3 medium | 0.00% | svenbluege, event_gallery | Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches. | 14 Oct |
| CVE-2026-102783 | 6.3 medium | 0.00% | no CPE yet | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure. | 8 Oct |
| CVE-2026-65712 | 6.2 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata. | Sat 24 Oct |
| CVE-2026-65756 | 6.1 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. | Sat 24 Oct |
| CVE-2026-65882 | 6.1 medium | 0.00% | no CPE yet | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector. | Sat 24 Oct |
| CVE-2026-61901 | 6.1 medium | 0.00% | no CPE yet | Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect. | 23 Oct |
| CVE-2026-65946 | 6.1 medium | 0.00% | rolandd, ro_csvi | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 | 23 Oct |
| CVE-2026-66490 | 6.1 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 | 23 Oct |
| CVE-2025-55757 | 6.1 medium | 0.00% | no CPE yet | A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered. | 8 Oct |
| CVE-2026-21631 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of output escaping leads to a XSS vector in the multilingual associations component. | Mon 26 Oct |
| CVE-2026-21632 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of output escaping for article titles leads to XSS vectors in various locations. | Mon 26 Oct |
| CVE-2026-48949 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of validation leads to an XSS vulnerability in the MFA management views. | Sun 25 Oct |
| CVE-2026-48950 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | Sun 25 Oct |
| CVE-2026-48951 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | Sun 25 Oct |
| CVE-2026-48952 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | Sun 25 Oct |
| CVE-2026-48953 | 5.9 medium | 0.00% | joomla, joomla\! | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | Sun 25 Oct |
| CVE-2026-48954 | 5.9 medium | 0.00% | joomla, joomla\! | Improper validation leads to a generic XSS vector in the language override feature. | Sun 25 Oct |
| CVE-2026-64795 | 5.4 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers. | Sat 24 Oct |
| CVE-2026-64871 | 5.4 medium | 0.00% | no CPE yet | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission. | Sat 24 Oct |
| CVE-2025-55758 | 5.4 medium | 0.00% | no CPE yet | Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered. | 8 Oct |
| CVE-2026-102799 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 | Wed 28 Oct |
| CVE-2026-97165 | 5.3 medium | 0.00% | svenbluege, event_gallery | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated. | Tue 27 Oct |
| CVE-2026-100753 | 5.3 medium | 0.00% | ordasoft, real_estate_manager | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link. | Tue 27 Oct |
| CVE-2026-101109 | 5.3 medium | 0.00% | ordasoft, vehicle_manager | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page. | Tue 27 Oct |
| CVE-2026-102787 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | Tue 27 Oct |
| CVE-2026-63264 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller. | Sat 24 Oct |
| CVE-2026-58149 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses. | Sat 24 Oct |
| CVE-2026-66488 | 5.3 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 | 23 Oct |
| CVE-2026-66489 | 5.3 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 | 23 Oct |
| CVE-2026-77028 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66 | 23 Oct |
| CVE-2026-67284 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.3 - Authenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on files owned by other users. | 23 Oct |
| CVE-2026-77993 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | 23 Oct |
| CVE-2026-102426 | 5.3 medium | 0.00% | ollyo, sp_page_builder | Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value. | 14 Oct |
Download these 219 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.