Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.43%Sep 22, 2026
- UnknownJoomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 99.83%Sep 11, 2026
- High8.6Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Si…Check if you run itEPSS 0.52%Aug 21, 2026
- Medium5.1Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded…Check if you run itEPSS 0.54%Aug 21, 2026
- Medium6.3Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another cu…Check if you run itEPSS 0.41%Aug 21, 2026
- High8.7Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as…Check if you run itEPSS 0.41%Aug 21, 2026
- Medium5.3Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token cou…Check if you run itEPSS 0.19%Aug 21, 2026
- Medium5.3Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66Check if you run itEPSS 0.41%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject…Check if you run itEPSS 0.37%Aug 21, 2026
- High8.6Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field eleme…Check if you run itEPSS 0.44%Aug 21, 2026
- Medium6.9Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.Check if you run itEPSS 0.50%Aug 21, 2026
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…Check if you run itEPSS 0.47%Aug 21, 2026
- Medium4.6Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66Check if you run itEPSS 0.21%Aug 21, 2026
- Unknown[20260810] - Core - Unrestricted uploads of SHTML filesCheck if you run itEPSS 0.65%Aug 17, 2026
- Unknown[20260809] - Core - Improper ACL checks when injection schema.org contact dataCheck if you run itEPSS 0.29%Aug 17, 2026
- Unknown[20260808] - Core - Improper ACL checks for batch copy actionsCheck if you run itEPSS 0.29%Aug 17, 2026
- Unknown[20260807] - Core - MFA Authentication BypassCheck if you run itEPSS 0.46%Aug 17, 2026
- Unknown[20260806] - Core - XSS through schema.org outputsCheck if you run itEPSS 0.27%Aug 17, 2026
- Unknown[20260805] - Core - Improper ACL checks for category webservice endpointsCheck if you run itEPSS 0.26%Aug 17, 2026
- Unknown[20260804] - Core - Improper ACL checks for custom fields webservice endpointsCheck if you run itEPSS 0.26%Aug 17, 2026
- Unknown[20260803] - Core - Inconsistent ACL checks for mutating webservice endpointsCheck if you run itEPSS 0.34%Aug 17, 2026
- Unknown[20260802] - Core - Improper CORS origin validationCheck if you run itEPSS 0.34%Aug 17, 2026
- Unknownollyo helix3 Improper Access ControlPatch nowKEVEPSS 0.99%Aug 11, 2026
- Unknownbalbooa gridbox Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.52%Jul 29, 2026
- Unknownbalbooa gridbox Improper Access ControlPatch nowKEVEPSS 0.52%Jul 29, 2026