Vulnerabilities
Summary — last 7 days
New vulnerabilities5,493▲ 2,243 vs. last week
Critical / high2,824▲ 1,265 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)599▲ 391 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Analyzed | Medium (6.9) | 0.26% | — | Techfry TF Content | 10/5/2026 | 10/16/2026 | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of… | |
| Analyzed | Medium (6.9) | 0.29% | — | Techfry TF Content | 10/5/2026 | 10/14/2026 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the… |