CVE-2026-102784 - Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesCon

CVE-2026-102783 - Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contai

CVE-2026-102782 - Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.

CVE-2026-102781 - Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

CVE-2026-102779 - Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in

CVE-2026-102780 - Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in T

CVE-2026-102778 - Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in

CVE-2026-102776 - Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event

CVE-2026-102775 - Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View

CVE-2026-102428 - Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - Th

CVE-2026-102426 - Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Bui

CVE-2026-102427 - Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3

CVE-2026-76570 - Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTable

CVE-2026-92232 - Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTM

CVE-2026-92231 - Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch

CVE-2026-92227 - Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.

CVE-2026-92226 - Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.

CVE-2026-92225 - Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The modul

CVE-2026-92224 - Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - T

CVE-2026-92223 - Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.

CVE-2026-92222 - Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.

CVE-2026-90918 - Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - T

CVE-2026-90917 - Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5

CVE-2026-90916 - Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla

CVE-2026-90915 - Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0

CVE-2026-90914 - Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.

CVE-2026-90913 - Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joom

CVE-2026-90907 - Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in

CVE-2026-90906 - Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack

CVE-2026-102425 - Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms

CVE-2026-102424 - Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto

CVE-2026-101127 - Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3

CVE-2026-101126 - Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final for

CVE-2026-101112 - Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - T

CVE-2026-101111 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - Th

CVE-2026-101110 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - sit

CVE-2026-101109 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 -

CVE-2026-101108 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 -

CVE-2026-100753 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7

CVE-2026-100752 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.

CVE-2026-100751 - Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Ac

CVE-2026-100750 - Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modul

CVE-2026-97165 - Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.

CVE-2026-97164 - Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Ev

CVE-2026-100749 - Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.

CVE-2026-100748 - Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

CVE-2026-100747 - Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to

CVE-2026-97163 - Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0

CVE-2026-97162 - Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0

CVE-2026-97161 - Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5

CVE-2026-97160 - Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extensio

CVE-2026-94132 - Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in

CVE-2026-94131 - Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise

CVE-2026-94130 - Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7

CVE-2026-90905 - Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in

CVE-2026-90904 - Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editi

CVE-2026-90903 - Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API En

CVE-2026-90902 - Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in

CVE-2026-90901 - Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion

CVE-2026-90900 - Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Sub

CVE-2026-90899 - Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy

CVE-2026-88857 - Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla

CVE-2026-88856 - Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla

CVE-2026-88855 - Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery

CVE-2026-88854 - Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension

CVE-2026-84048 - Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoi

CVE-2026-82191 - Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in

CVE-2026-82190 - Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2,

CVE-2026-82189 - Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2,

CVE-2026-81568 - Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2,

CVE-2026-81567 - Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product li

CVE-2026-78081 - Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controll

CVE-2026-79701 - Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact,

CVE-2026-81566 - Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder

CVE-2026-81565 - Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder

CVE-2026-81564 - Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary

CVE-2026-79700 - Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Co

CVE-2026-78375 - Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of

CVE-2026-88853 - Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro ex

CVE-2026-88852 - Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension

CVE-2026-85196 - Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.

CVE-2026-85195 - Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere exte

CVE-2026-85192 - Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional

CVE-2026-85191 - Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordion

CVE-2026-85190 - Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension

CVE-2026-85189 - Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals exte

CVE-2026-85188 - Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro)

CVE-2026-78085 - Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.

CVE-2026-78374 - Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder exten

CVE-2026-78303 - Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Req

CVE-2026-78302 - Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped

CVE-2026-78084 - Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Propert

CVE-2026-78083 - Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Co

CVE-2026-78082 - Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filteri

CVE-2026-78080 - Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid

CVE-2026-78069 - Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2S

CVE-2026-78065 - Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDO

CVE-2026-78064 - Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in

CVE-2026-78000 - Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2S

CVE-2026-77999 - Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirm

CVE-2026-78079 - Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.

CVE-2026-78078 - Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ulti

CVE-2026-78077 - Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container

CVE-2026-78076 - Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settin

CVE-2026-78075 - Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Heli

CVE-2026-78074 - Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various

CVE-2026-78073 - Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user suppli

CVE-2026-78072 - Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

CVE-2026-78071 - Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19

CVE-2026-78070 - Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5

CVE-2026-77991 - Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager

CVE-2026-77990 - Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla

CVE-2026-77989 - Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events M

CVE-2026-77035 - Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form

CVE-2026-77034 - Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in J

CVE-2026-77997 - Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1

CVE-2026-77996 - Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

CVE-2026-77995 - Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, O

CVE-2026-77994 - Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla

CVE-2026-77993 - Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Pag

CVE-2026-77992 - Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2

CVE-2026-77027 - Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of use

CVE-2026-76609 - Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - Th

CVE-2026-76608 - Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fab

CVE-2026-76607 - Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2.

CVE-2026-76606 - Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.

CVE-2026-76605 - Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.

CVE-2026-76604 - Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabr

CVE-2026-76603 - Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7

CVE-2026-76602 - Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The

CVE-2026-76601 - Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugi

CVE-2026-76600 - Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The De

CVE-2026-76599 - Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in

CVE-2026-76598 - Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders

CVE-2026-76597 - Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email p

CVE-2026-76596 - Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.

CVE-2026-76571 - Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter i

CVE-2026-66917 - Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, pr

CVE-2026-66916 - Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in Jo

CVE-2026-74252 - Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.

CVE-2026-67362 - Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-

CVE-2026-67361 - Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in

CVE-2026-67360 - Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-

CVE-2026-67359 - Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1

CVE-2026-67358 - Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.2

CVE-2026-77028 - Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parame

CVE-2026-76613 - Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.

CVE-2026-76612 - Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1

CVE-2026-76611 - Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery elemen

CVE-2026-75115 - Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.

CVE-2026-77029 - Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVE-2026-77026 - Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.

CVE-2026-76610 - Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment co

CVE-2026-76569 - Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1

CVE-2026-76565 - Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Car

CVE-2026-76564 - Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.

CVE-2026-75948 - Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The fronte

CVE-2026-75956 - Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirector

CVE-2026-75955 - Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - co

CVE-2026-75954 - Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - S

CVE-2026-75953 - Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient addre

CVE-2026-75952 - Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Toke

CVE-2026-75951 - Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions)

CVE-2026-75950 - Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory

CVE-2026-75949 - Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessD

CVE-2026-75114 - Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo <

CVE-2026-74804 - Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo

CVE-2026-74803 - Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image

CVE-2026-67364 - Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's

CVE-2026-67363 - Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The

CVE-2026-73372 - Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1

CVE-2026-73336 - Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Impr

CVE-2026-72531 - Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0

CVE-2026-71573 - Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An

CVE-2026-71572 - Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0

CVE-2026-73373 - Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 -

CVE-2026-73371 - Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-

CVE-2026-73337 - Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insuff

CVE-2026-72532 - Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.

CVE-2026-71574 - Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.

CVE-2026-74254 - Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Pag

CVE-2026-74253 - Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in

CVE-2026-74251 - Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.

CVE-2026-71570 - Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A

CVE-2026-67366 - Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 -

CVE-2026-71571 - Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCage

CVE-2026-67365 - Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthe

CVE-2026-73327 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the re

CVE-2026-67287 - Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An

CVE-2026-67286 - Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in S

CVE-2026-67285 - Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Bu

CVE-2026-67284 - Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud

CVE-2026-67283 - Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud

CVE-2026-67282 - Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unaut

CVE-2026-66915 - Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attac

CVE-2026-66914 - Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1

CVE-2026-66494 - Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builde

CVE-2026-66493 - Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper

CVE-2026-66492 - Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper

CVE-2026-66491 - Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitati

CVE-2026-65947 - Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

CVE-2026-65888 - Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogi

CVE-2026-65887 - Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The

CVE-2026-65886 - Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo

CVE-2026-66490 - Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.

CVE-2026-66489 - Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

CVE-2026-66488 - Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

CVE-2026-65890 - Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi v

CVE-2026-65889 - Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generat

CVE-2026-65946 - Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

CVE-2026-65944 - Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

CVE-2026-65943 - Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

CVE-2026-65891 - Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite

CVE-2026-65885 - Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File uplo

CVE-2026-65884 - Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method

CVE-2026-65883 - Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guar

CVE-2026-65882 - Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url param

CVE-2026-65881 - Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account acces

CVE-2026-65880 - Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An

CVE-2026-65879 - Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret

CVE-2026-65878 - Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1-

CVE-2026-65877 - Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improp

CVE-2026-65876 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Impr

CVE-2026-65766 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Impr

CVE-2026-65765 - Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper

CVE-2026-65764 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper valid

CVE-2026-65762 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper

CVE-2026-65761 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.

CVE-2026-65760 - Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy

CVE-2026-65759 - Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.

CVE-2026-65758 - Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The

CVE-2026-65757 - Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules An

CVE-2026-65756 - Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configura

CVE-2026-65755 - Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Use

CVE-2026-65754 - Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer

CVE-2026-65713 - Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery

CVE-2026-65712 - Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN ve

CVE-2026-65431 - Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives ha

CVE-2026-65430 - Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credent

CVE-2026-64876 - Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP ext

CVE-2026-64875 - Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups tr

CVE-2026-64874 - Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden

CVE-2026-64873 - Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could a

CVE-2026-64872 - Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge an

CVE-2026-64871 - Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Clea

CVE-2026-64799 - Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users

CVE-2026-64798 - Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL

CVE-2026-64797 - Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trus

CVE-2026-64796 - Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free di