10
CVEs
2
Critical
4
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
4
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74803 | Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-74804 | SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to inject arbitrary SQL through the filter_type and type_filter request parameters, which are concatenated directly into a.type comparison clauses in ItemController::element() without quoting or escaping. All Zoo versions before 4.1.64 are affected, and because no authentication or user interaction is required, an attacker can read or manipulate the Joomla database over the network. No public exploit has been identified at time of analysis, but the trivial exploitation profile (CVSS 9.3) makes weaponization straightforward. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-76612 | Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. No public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-76613 | SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embed arbitrary SQL content into backend queries, potentially exposing or corrupting the entire Joomla site database including user credentials and content. The vulnerability spans the full release history of the extension through 5.0.40 and is particularly dangerous in multi-author or open-registration Joomla deployments where untrusted users hold contributor roles. No public exploit code has been identified at time of analysis, and CISA SSVC confirms current exploitation status as none, though SSVC also rates the technical impact as total if exploitation occurs. | HIGH | 8.6 | 0.3% | 43 |
No patch
|
| CVE-2026-77996 | Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-75115 | Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.0 reflects the high confidentiality impact from unrestricted file reads. | HIGH | 7.0 | 0.3% | 35 |
No patch
|
| CVE-2026-76611 | Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes server-side directory structures to any remote, unauthenticated attacker on sites running Zoo versions prior to 4.1.66. The path traversal vulnerability (CWE-22) allows crafted requests to enumerate directories outside the intended scope of the Gallery element, potentially revealing sensitive filesystem layout including configuration paths, user data directories, or other installed components. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-77028 | Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-75114 | Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers to redirect authenticated users to arbitrary external URLs. The vulnerability exists in CommentController::twitterAuthenticate(), where the referer request parameter is forwarded without validation directly to setRedirect(). No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-77997 | Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users holding only com_template editing permissions to read metadata about arbitrary Joomla modules - access that normally requires the separate com_modules permission. The root cause is CWE-284 (Improper Access Control): the extension's template editor fails to verify whether the requesting user holds the appropriate module-management permission before returning module data. No public exploit identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege requirement and limited confidentiality impact. | MEDIUM | 5.1 | 0.2% | 26 |
No patch
|