CVE-2026-105607

HighCVSS 8.3/10Last modified Nov 6, 2026

Description

Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 5, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1056088.8HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user wCVE-2026-1056110.0IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bCVE-2026-1056104.7A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/bladCVE-2026-1056112.7A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-systCVE-2026-1056124.3PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is CVE-2026-1056135.8PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memorCVE-2026-1056144.7PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to proCVE-2026-1056154.3PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore reaCVE-2026-1056166.5PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visibleCVE-2026-1056176.5PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the uCVE-2026-1056186.5PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inherCVE-2026-1056196.5PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and la
CVE-2026-105607: High severity, CVSS 8.3 | Vulnix