19
CVEs
9
Critical
5
High
0
KEV
0
PoC
14
Unpatched C/H
0.0%
Patch Rate
3.4%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
5
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-67282 | Remote code execution in the Fabrik application-builder extension for Joomla (all versions before 4.6.8) lets an unauthenticated attacker run arbitrary code on the server via the frontend listfilter model. The flaw is a CWE-94 code injection reachable over the network with no authentication or user interaction, and the vendor rates it maximum severity (CVSS 4.0 base 10.0). No public exploit code has been identified at the time of analysis, and it is not listed in CISA KEV, but the combination of unauthenticated access and full code execution makes it a top-priority patch. | CRITICAL | 10.0 | 57.0% | 107 |
No patch
|
| CVE-2026-66915 | Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. CVSS 4.0 rates this 10.0 (maximum); no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 10.0 | 0.8% | 51 |
No patch
|
| CVE-2026-76604 | Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate. | CRITICAL | 10.0 | 0.7% | 51 |
No patch
|
| CVE-2026-76605 | Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote unauthenticated attackers inject and execute arbitrary code by abusing the image element type, per its CVSS 4.0 base score of 10.0 (CWE-94). The flaw grants full compromise of the underlying Joomla host, with confidentiality, integrity, and availability impact on both the vulnerable application and subsequent systems. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 10.0 | 0.7% | 51 |
No patch
|
| CVE-2026-76606 | Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers manipulate file paths through the image element to reach files outside the intended directory. The vendor's CVSS 4.0 score of 10.0 with PR:N indicates unauthenticated network exploitation, though there is no public exploit identified at time of analysis. The affected component is a form/data-application builder, so exploitation could expose or tamper with files on the Joomla host. | CRITICAL | 10.0 | 0.5% | 50 |
No patch
|
| CVE-2026-76607 | Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-77992 | Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of a heredoc terminator inside the 'calc' element and inject arbitrary PHP, made reachable because the onUpdateComment endpoint performs no access checks. Any remote actor able to reach the endpoint can trigger evaluation of attacker-controlled code, yielding full compromise of the Joomla application context (CWE-94). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 9.5 | 0.4% | 48 |
No patch
|
| CVE-2026-76571 | Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixed in 4.7.3) lets remote attackers read the entire backing database. The flaw sits in getFilterQuery(), where the user-controlled list-filter 'condition' parameter is concatenated verbatim into a WHERE clause, so no authentication or user interaction is needed. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided. | CRITICAL | 9.3 | 0.4% | 47 |
No patch
|
| CVE-2026-76602 | Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers inject SQL through the 'order' parameter of list models, which is passed into ORDER BY clauses without validation. Because the vector is exposed without authentication over the network, any anonymous visitor to a Fabrik-powered list can extract database contents. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.4% | 47 |
No patch
|
| CVE-2026-76598 | Unauthenticated remote attackers can invoke the onAjax_getFolders AJAX method in the Fabrik Extension for Joomla to enumerate arbitrary server-side directories, exposing file system structure without credentials or user interaction. All versions from 1.0.0 through 4.7.1 are affected across the extension's full release history; version 4.7.2 was released to remediate the flaw. No public exploit code or CISA KEV-confirmed active exploitation has been identified at time of analysis, though the unauthenticated network-accessible nature of the endpoint lowers the bar for opportunistic reconnaissance by automated scanners. | HIGH | 8.7 | 0.5% | 44 |
No patch
|
| CVE-2026-76597 | Unauthenticated arbitrary file upload to the web root is possible in Fabrik (a Joomla extension by fabrikar.com) versions 1.0.0 through 4.7.1, via the list email plugin controller which applies no access control before processing uploads. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero authentication and zero complexity requirements against any publicly reachable Joomla deployment running the affected extension. The description constrains uploads to non-executable files, which limits direct remote code execution on hardened servers, but still enables web root content injection, defacement, and potential escalation on misconfigured systems. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-76596 | Unauthenticated table truncation in the Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) allows any remote attacker to destroy data by issuing a single HTTP GET request to the list.doempty controller action. The endpoint lacks all ACL gates, making exploitation trivially automatable against any publicly accessible Joomla installation running the affected component. No public exploit has been identified at time of analysis, but the absence of any authentication or complexity barrier means the effective exploitation threshold is near zero. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-76599 | Unauthenticated database schema disclosure in Fabrik for Joomla (versions 1.0.0-4.7.1) exposes arbitrary table names, column listings, and the Joomla database table prefix to any remote attacker without credentials. The vulnerable ajax_tables method in the extension's elements model responds to AJAX requests without enforcing access control, violating the principle of least privilege (CWE-284). No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low attack complexity and the high value of schema metadata for downstream attacks. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-77027 | Stored cross-site scripting in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript via the jsactions feature. When any authenticated user - including site administrators - views content containing the malicious payload, the script executes in their browser context, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write path combined with high confidentiality and integrity impact (CVSS 4.0: 8.6) makes this a meaningful risk for Joomla sites running Fabrik. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-76600 | Unauthenticated comment deletion in Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) is possible because the DeleteComment endpoint performs no access control verification of any kind - a straightforward CWE-284 (Improper Access Control) failure. Any remote, unauthenticated party with network access to a Joomla installation running the affected extension can delete arbitrary comments by targeting their IDs. No active exploitation or public exploit code has been identified at time of analysis; the fix is available in version 4.7.2. | MEDIUM | 6.9 | 0.4% | 35 |
No patch
|