Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-65884 | 10.0 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions. | Fri 23 Oct |
| CVE-2026-65887 | 10.0 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins. | Fri 23 Oct |
| CVE-2026-65888 | 10.0 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site. | Fri 23 Oct |
| CVE-2026-61425 | 9.4 critical | 1.0% | no CPE yet | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. | Sat 24 Oct |
| CVE-2026-65885 | 9.4 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker. | Fri 23 Oct |
| CVE-2026-65890 | 9.2 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries. | Fri 23 Oct |
| CVE-2026-65886 | 9.2 critical | 1.0% | balbooa, gridbox | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files. | Fri 23 Oct |
| CVE-2026-102788 | 9.3 critical | 0.00% | no CPE yet | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist | Tue 27 Oct |
| CVE-2026-102789 | 9.3 critical | 0.00% | no CPE yet | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check. | Tue 27 Oct |
| CVE-2026-65889 | 9.2 critical | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories. | Fri 23 Oct |
| CVE-2026-102784 | 8.7 high | 0.00% | no CPE yet | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request. | 8 Oct |
| CVE-2026-65947 | 7.3 high | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 | Fri 23 Oct |
| CVE-2026-102783 | 6.3 medium | 0.00% | no CPE yet | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure. | 8 Oct |
| CVE-2026-66490 | 6.1 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 | Fri 23 Oct |
| CVE-2026-66488 | 5.3 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 | Fri 23 Oct |
| CVE-2026-66489 | 5.3 medium | 0.00% | balbooa, gridbox | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 | Fri 23 Oct |
16 of 16
Download these 16 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.