Fabrik fixes critical unauthenticated RCE
Fabrik for Joomla up to version 4.6.6 contains an unauthenticated remote code execution flaw in its calc element. Tracked as CVE-2026-66915, the issue has a…
Security
Security releases, vulnerabilities and hardening for Joomla.
Critical Gridbox flaws fixed in Joomla extension update
Balbooa’s Joomla page builder Gridbox contains 23 critical vulnerabilities, including pre-authentication remote code execution. mySites.guru says some flaws…
JCE 2.9.99.10 fixes privileged file rename flaw
JCE 2.9.99.10 fixes a file-handling vulnerability that could let a privileged, authenticated user hide a file in the directory they were viewing.
SP Page Builder 6.7.1 fixes four Joomla vulnerabilities
JoomShaper has released SP Page Builder 6.7.1 to fix four vulnerabilities affecting version 6.7.0 and earlier, including a pre-authentication SQL injection and…
Joomla AJAX handlers remain an overlooked security risk
Joomla sites are facing continued automated scanning in 2026 for AJAX handlers that verify neither authentication nor permissions, leaving extensions and…
EasyStore 2.0.2 fixes three Joomla security flaws
JoomShaper’s EasyStore ecommerce extension for Joomla contained three serious vulnerabilities before version 2.0.2, including flaws that could expose customer…
Regular Labs patches Joomla extensions across its catalogue
Regular Labs has released security fixes across roughly 30 Joomla extensions, addressing issues including SSRF, command injection and stored XSS…
PageBuilder CK fix left Joomla RCE open to Editors
Joomlack has released PageBuilder CK 3.6.3 after researchers found that versions 3.6.0 through 3.6.2 only partially fixed a critical file-upload vulnerability…
Events Booking flaw exposed registrants’ invoices
A security flaw in the Joomla Events Booking extension allowed unauthenticated visitors to download other registrants’ invoices, exposing personal and payment…
Membership Pro 4.6.2 fixes critical anonymous upload flaw
JoomDonation has released Membership Pro 4.6.2 to address a critical unauthenticated file upload vulnerability affecting versions through 4.6.1.
Critical Gridbox authentication bypass fixed in Joomla extension
A critical authentication bypass in Balbooa’s Gridbox extension for Joomla allowed unauthenticated visitors to obtain Super User access by setting a browser…
Events Booking flaws allowed uploads and user-data exposure
Two unauthenticated vulnerabilities in JoomDonation’s Events Booking Joomla extension allowed anonymous file uploads and exposed users’ names and email…