Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-66492exploit | 6.1 medium | 1.0% | no CPE yet | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability. | Sat 24 Oct |
| CVE-2026-66491exploit | 8.2 high | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability. | Sat 24 Oct |
| CVE-2026-66493exploit | 6.4 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities. | Sat 24 Oct |
| CVE-2026-57828 | 9.0 critical | 1.0% | phoca, download | Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE. | Sun 25 Oct |
| CVE-2026-102775 | 8.7 high | 0.00% | phoca, phoca_cart | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens. | 14 Oct |
| CVE-2026-102786 | 8.6 high | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | Fri 23 Oct |
| CVE-2026-65765 | 6.9 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities. | Sat 24 Oct |
| CVE-2026-23900 | 6.5 medium | 0.00% | phoca, maps | Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered. | Mon 26 Oct |
| CVE-2026-102787 | 5.3 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | Tue 27 Oct |
| CVE-2026-65762 | 5.1 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Sat 24 Oct |
| CVE-2026-65763 | 5.1 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Sat 24 Oct |
| CVE-2026-65764 | 5.1 medium | 0.00% | no CPE yet | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Sat 24 Oct |
12 of 12
Download these 12 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.