22
CVEs
3
Critical
11
High
0
KEV
0
PoC
13
Unpatched C/H
4.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
11
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
PHP
27
Open Redirect
6
Js Jobs
3
Easydiscuss
3
Jux Real Estate
3
Hikashop
2
Phpmailer
2
Debian Linux
2
Fedora
2
Snippets Pro Extension For Joomla
1
Insurance Ifrs 17 Analyzer
1
Junos
1
Financial Services Loan Loss Forecasting And Provisioning
1
Bi Publisher
1
Insurance Performance Insight
1
Joomshopping
1
Hospitality Simphony
1
Cloudforms
1
Jquery
1
Pharstreamwrapper
1
Articles Anywhere Free Pro Extension For Joomla
1
Retail Back Office
1
Financial Services Market Risk Measurement And Management
1
Tabs Accordions Free Pro Extension For Joomla
1
Financial Services Institutional Performance Analytics
1
Communications Session Report Manager
1
Business Process Management Suite
1
Leap
1
Agile Product Lifecycle Management For Process
1
Policy Automation Connector For Siebel
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85192 | Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account. | CRITICAL | 9.4 | 0.5% | 47 |
No patch
|
| CVE-2026-78082 | Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch. | CRITICAL | 9.3 | 0.5% | 47 |
No patch
|
| CVE-2025-40636 | SQL injection in Joomla mod_vvisit_counter v2.0.4j3. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-73327 | Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a Super User is socially engineered into extracting a crafted ZIP archive via the administrator interface. The extract.php extraction routine failed to validate ZIP entry filenames for parent-directory sequences (`..`), absolute Unix paths, Windows drive letter paths, or UNC paths - allowing an attacker-supplied archive to write arbitrary PHP files outside the intended extraction root. No confirmed active exploitation (not in CISA KEV); an upstream patch is available via GitHub commit and PR, though a tagged patched release version has not been independently confirmed. | HIGH | 8.7 | 0.9% | 44 |
|
| CVE-2026-21625 | Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-78302 | Stored XSS in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated remote attackers to inject persistent JavaScript payloads into property listings and related content. Multiple template files across both frontend views and administrator list tables rendered user-supplied attributes and text values directly into HTML without contextual output escaping, enabling the stored payload to execute in the browser of any user who views the affected page - including Joomla administrators. No public exploit code has been identified and this vulnerability is not currently listed in CISA KEV, but the stored nature and admin-context execution make this a high-priority remediation target for any site running the affected extension. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-78375 | Authenticated SQL injection in JoomShaper's SP Page Builder Joomla extension (versions 5.2.1-6.9.0) lets backend-privileged users perform time-based blind SQL injection against the full Joomla database, including credential hash and active session tables. The `plgContentSppagebuilder::onContentAfterSave()` content plugin method directly concatenates a POST-supplied array element into a raw SQL `WHERE` clause without quoting or integer casting, and Joomla's own ARRAY input filter provides no sanitization of element values. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as none. | HIGH | 8.6 | – | 43 |
No patch
|
| CVE-2026-85191 | Stored cross-site scripting in regularlabs.com's Tabs & Accordions (Free and Pro) extension for Joomla, versions prior to 3.1.0, allows a privileged authenticated attacker to inject and permanently persist arbitrary JavaScript into page output by supplying a crafted value in the rtla-alias configuration field. The extension's link-rewriting renderer embeds the alias directly into an HTML onclick attribute as a JavaScript string argument, applying neither JavaScript-string escaping nor HTML-attribute encoding, so a crafted alias breaks both quoting contexts and executes in every subsequent visitor's browser. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-88853 | Stored cross-site scripting in the Modals Pro extension for Joomla (regularlabs.com) versions prior to 17.0.0 allows an authenticated Author-level user to inject executable JavaScript via documented event handler options (on-open, on-closed) embedded in article content. The extension intentionally supports JavaScript lifecycle events for modal dialogs but fails to enforce access control distinguishing which roles may supply executable code versus static configuration parameters - enabling a lower-privileged author to weaponize a trusted-user feature. When a higher-privileged user views the crafted article, the modal fires the injected script in their browser context. No public exploit or CISA KEV listing exists at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85189 | Stored cross-site scripting in the Regular Labs Modals extension for Joomla (all versions before 17.0.0) allows high-privileged content authors to inject executable browser URL schemes - such as javascript: - into modal destination fields, which the extension passes unvalidated into both the generated anchor href and the iframe source path. When any site visitor subsequently renders the affected page, the stored payload executes as JavaScript in their browser without requiring the Pro JavaScript Events feature to be enabled. No public exploit has been identified at time of analysis; the vendor-released fix is version 17.0.0. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-85195 | Stored XSS in regularlabs.com's Articles Anywhere Joomla extension (versions prior to 20.0.0) lets authenticated article authors inject arbitrary JavaScript via link event handler options (onclick, onmouseover) in plugin syntax tags. The injected payload bypasses Joomla's built-in Author content filter because Articles Anywhere renders the event handler attributes into live HTML after the CMS filter has already processed the content. No public exploit has been identified at time of analysis, but the filter-bypass is architectural and cannot be mitigated without patching. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-88852 | Stored cross-site scripting in the Regular Labs Snippets extensions for Joomla (Free < 7.0.0, Pro < 11.0.0) allows a lower-privileged Joomla author to inject malicious script into Snippet content by passing an unsafe value through the extension's article tag variable substitution mechanism, specifically via the url option. Because the affected versions do not validate the article author's trust level before substituting their tag-supplied variables into security-sensitive positions defined by a trusted Snippet author, the injected payload executes in the browser of any higher-privileged user who views the rendered article. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-78083 | Cross-site request forgery in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated attackers to forge POST requests against two unprotected endpoints. The visitor property booking endpoint (properties.booking) and agent contact form endpoint (agents.sendmail) both processed POST submissions without validating Joomla's built-in session anti-CSRF tokens, enabling an attacker who tricks a site visitor into loading a malicious page to submit fraudulent bookings or send arbitrary contact messages on that visitor's behalf. No public exploit has been identified at time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-81564 | Arbitrary file rename across the Joomla filesystem is possible in SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 due to missing directory confinement in the media rename controller task. Authenticated administrators or users with media management permissions can pair any valid media identifier with an unrelated filesystem path, bypassing the boundary checks that protect other folder operations in the same controller. An attacker exploiting this flaw can rename files outside the intended media directory - including renaming configuration.php - effectively taking the entire Joomla site offline or disrupting its integrity. No public exploit or active exploitation has been identified at time of analysis. | HIGH | 7.0 | – | 35 |
No patch
|
| CVE-2026-78303 | SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form. | MEDIUM | 6.9 | 0.4% | 35 |
No patch
|