Vulnerabilities
Summary — last 7 days
New vulnerabilities2,731▼ 88 vs. last week
Critical / high1,419▲ 189 vs. last week
New active exploitation (KEV)5▼ 5 vs. last week
Unscored (no CVSS)83▼ 429 vs. last week
13 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | High (7.3) | 0.19% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 | |
| Analyzed | Critical (10) | 0.52% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site. | |
| Analyzed | Critical (10) | 0.52% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins. | |
| Analyzed | Critical (9.2) | 0.55% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files. | |
| Analyzed | Medium (6.1) | 0.27% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 | |
| Analyzed | Medium (5.3) | 0.35% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 | |
| Analyzed | Medium (5.3) | 0.34% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 | |
| Analyzed | Critical (9.2) | 0.50% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries. | |
| Analyzed | Critical (9.2) | 0.44% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories. | |
| Analyzed | Critical (9.4) | 0.52% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker. | |
| Analyzed | Critical (10) | 0.52% | — | Balbooa Gridbox | 7/29/2026 | 8/5/2026 | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions. | |
| Deferred | Critical (9.4) | 0.57% | — | Balbooa GridboxAI | 7/20/2026 | 7/23/2026 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. | |
| Modified | Medium (6.1) | 34% | — | Balbooa Gridbox | 6/14/2018 | 6/17/2026 | The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the… |