CVE-2026-107130

MediumCVSS 6.9/10Last modified Nov 6, 2026

Description

Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 5, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-107148.8A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta WeCVE-2026-1071456.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limitingCVE-2026-1071466.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of serCVE-2026-1071476.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lCVE-2026-107155.1Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticCVE-2026-1071515.9Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbCVE-2026-1071527.1An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any clieCVE-2026-1071537.0Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physiCVE-2026-1071548.8A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially eCVE-2026-1071558.8A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could pCVE-2026-1071572.0Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application anCVE-2026-1071585.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that
CVE-2026-107130: Medium severity, CVSS 6.9 | Vulnix