CVE-2026-102780

The Joomla Extension - joomlafry.com - TF Content (versions 2.9.0 - 2.9.4 ) is vulnerable to unauthenticated cross-record publication and mass assignment . The root cause is that the public RecordController unconditionally authorizes both creation and editing actions. Additionally, the shared fro...

CVE-2026-102779

The Joomla Extension - joomlafry.com (TF Content) versions 2.9.0 through 2.9.4 is vulnerable to unauthenticated forced execution of published automation tasks. The component fails to enforce authentication, ACL, CSRF, task-trigger, content-binding, or cron-token protections on the records.custom_...