https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-102777.htmlhttps://patchthecve.com/cve/CVE-2026-102777.htmlWed, 14 Oct 2026 18:46:34 +0000MEDIUM 6.5: Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos accounhttps://patchthecve.com/cve/CVE-2026-102778.htmlhttps://patchthecve.com/cve/CVE-2026-102778.htmlWed, 14 Oct 2026 18:48:30 +0000MEDIUM 6.1: Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. https://patchthecve.com/cve/CVE-2026-102776.htmlhttps://patchthecve.com/cve/CVE-2026-102776.htmlWed, 14 Oct 2026 18:48:46 +0000MEDIUM 4.3: Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and