39
CVEs
8
Critical
20
High
0
KEV
0
PoC
28
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
20
MEDIUM
11
LOW
0
Monthly CVE Trend
Affected Products (30)
Conditional Content Extension For Joomla
5
Articles Anywhere Extension For Joomla
5
Geoip Extension For Joomla
5
Content Templater Pro Extension For Joomla
4
Sourcerer Extension For Joomla
4
Modules Anywhere Extension For Joomla
4
Advanced Module Manager Extension For Joomla
4
Users Anywhere Pro Extension For Joomla
3
Articles Anywhere Pro Extension For Joomla
3
Users Anywhere Extension For Joomla
3
Rereplacer Extension For Joomla
3
Ip Login Extension For Joomla
3
Cache Cleaner Pro Extension For Joomla
3
Rereplacer Extension Pro For Joomla
3
Cache Cleaner Extension For Joomla
2
Snippets Pro Extension For Joomla
2
Snippets Extension For Joomla
2
Modals Extension For Joomla
2
Db Replacer Extension For Joomla
2
PHP
2
Rereplacer Pro Extension For Joomla
2
Keyboard Shortcuts Extension For Joomla
2
Regular Labs Extension Manager Extension For Joomla
2
Tooltips Extension For Joomla
2
Content Templater Extension For Joomla
2
Modals Pro Extension For Joomla
2
What Nothing Extension For Joomla
1
Modals Free Pro Extension For Joomla
1
Quick Index Free Pro Extension For Joomla
1
Snippets Free Extension For Joomla
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74253 | Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-65431 | Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-64796 | Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows remote attackers with article editing access to execute arbitrary code on the server. The flaw stems from missing Super User checks in the Free edition and inconsistent permission enforcement across article owners, PHP/CSS/JavaScript settings, tag attributes, and file includes in the Pro edition. No public exploit or active exploitation is confirmed at this time, and the EPSS score indicates low exploitation probability (0.19%), though the CVSS base score is 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-64874 | Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-64873 | Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-85192 | Remote code execution in Regular Labs' Conditional Content Pro extension for Joomla (versions before 8.0.0) lets an author with article-publishing rights embed inline PHP inside Condition Rules, which the extension hands to its Conditions evaluator without verifying who authored the content. Because Joomla's standard Author text filter preserves the rule syntax, publishing a crafted article executes the attacker's PHP as the web-server process. No public exploit has been identified at time of analysis, and the flaw requires an authenticated, privileged Joomla account. | CRITICAL | 9.4 | 0.5% | 47 |
No patch
|
| CVE-2026-64798 | Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-64793 | Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling unauthenticated remote attackers to view restricted or unpublished articles and modules. The vulnerability stems from improper authorization enforcement when ignore | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-63685 | Database corruption or site takeover in DB Replacer extension for Joomla versions 1.0.0 through 8.2.7 allows unauthorized backend users or CSRF attacks to perform database replacements, risking major data corruption. The vulnerability arises from inconsistent enforcement of Super User permission and CSRF token validation on administrative routes and replacement requests. No public exploit has been identified at time of analysis, and EPSS estimates a low 0.2% probability of exploitation. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-63280 | We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-63684 | Missing CSRF tokens, item-permission, and input-validation checks in Regular Labs Joomla extensions (Content Templater, ReReplacer, Snippets) allow unauthorized backend users or CSRF attacks to expose, create, or modify extension configuration and items. This high-severity flaw (CVSS 8.8) affects multiple versions, with low exploitation probability (EPSS 0.13%). No active exploitation or public exploit code has been identified. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-64791 | Insufficient access controls in Regular Labs Extension Manager for Joomla (versions 1.0.0–9.2.5) allow an unauthenticated attacker via CSRF or a low-privilege backend user to install, update, or remove extensions. Successful exploitation can lead to complete site compromise through the installation of a malicious extension. EPSS probability is low (0.13%) and no active exploitation or public exploit code has been identified. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-64876 | Unauthorized database updates can be triggered via CSRF in the GeoIP extension for Joomla, affecting versions 1.0.0 through 6.3.8. An attacker can trick a logged-in Joomla administrator into submitting a request that performs unauthorized database modifications, potentially compromising all data confidentiality, integrity, and availability. EPSS indicates a low 0.13% exploitation probability, and no active exploitation or public exploit is known at this time. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-65757 | Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-63265 | We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization. CVSS score 8.0, vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-352. EPSS 0.13% (percentile 3%). Reported by: Joomla (probably the vendor). CPE list: many extensions for Joomla. Tags list includes many extension names. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD affected versions list for many extensions. References: regularlabs.com and vuldb.com. We must synthesize into a comprehensive analysis. Fields: - product_name: "1-3 words ONLY. The specific product or service name affected." Since it's multiple extensions, but the core issue is Regular Labs extensions for Joomla. I'll pick "Regular Labs Joomla Extensions" (1-3 words, "Regular Labs Joomla Extensions" is 3 words, fine. Could also say "Regular Labs for Joomla" but better to be specific. Description mentions "Privileged Regular Labs AJAX endpoints" so it's across many Regular Labs extensions. So product_name: "Regular Labs Joomla Extensions". This covers the vendor and platform. - summary: 2-3 sentence plain-language. Don't copy description. Original synthesis. Mention what vulnerability, affected product, what attacker can do, if actively exploited, POC, EPSS risk. This is a CSRF vulnerability allowing authenticated lower-privileged users or CSRF attacks to perform unauthorized actions. Starts with impact: "Cross-site request forgery (CSRF) in Regular Labs Joomla extensions allows authenticated lower-privileged users or CSRF attacks to invoke unauthorized AJAX lookups and mutations." Then "Affected extensions (e.g., Advanced Module Manager, Articles Anywhere, etc.) fail to consistent | HIGH | 8.0 | 0.1% | 40 |
No patch
|