Joomla - vulnerabilities (CVEs)

575 CVEs in 153 products, 16 in the last 30 days, newest from 2026-09-29.

Products

• Joomla! - 340 CVEs
• Joomla - 81 CVEs
• Bsq Sitestats - 6 CVEs
• Rs Gallery2 - 4 CVEs
• Com Beamospetition - 3 CVEs
• Com Weblinks - 3 CVEs
• Com Astatspro - 2 CVEs
• Com Downloads - 2 CVEs
• Com Facileforms - 2 CVEs
• Com Mailto - 2 CVEs
• Com Pcchess - 2 CVEs
• Com Pccookbook - 2 CVEs
• Com Rapidrecipe - 2 CVEs
• Com Sef - 2 CVEs
• Jd-wiki - 2 CVEs
• Joomla Core - 2 CVEs
• Akobook - 1 CVEs
• Be It Easypartner Component - 1 CVEs
• Bibtex - 1 CVEs
• Calendar Planner - 1 CVEs
• Car Manager - 1 CVEs
• Classifieds Component - 1 CVEs
• Colophon - 1 CVEs
• Com Acajoom - 1 CVEs
• Com Acctexp - 1 CVEs
• Com Artistavenue - 1 CVEs
• Com Awesom - 1 CVEs
• Com Biblestudy - 1 CVEs
• Com Books - 1 CVEs
• Com Brightweblinks - 1 CVEs
• Com Buslicense - 1 CVEs
• Com Camelcitydb2 - 1 CVEs
• Com Casiino Blackjack - 1 CVEs
• Com Casino - 1 CVEs
• Com Casino Videopoker - 1 CVEs
• Com Casinobase - 1 CVEs
• Com Clasifier - 1 CVEs
• Com Classifieds - 1 CVEs
• Com Comments - 1 CVEs
• Com Comprofiler - 1 CVEs
• Com Comprofiler Component - 1 CVEs
• Com Content - 1 CVEs
• Com Datsogallery - 1 CVEs
• Com Detail - 1 CVEs
• Com Dhforum - 1 CVEs
• Com Directory - 1 CVEs
• Com Doc - 1 CVEs
• Com Dtregister - 1 CVEs
• Com Elite Experts - 1 CVEs
• Com Eventing - 1 CVEs
• Com Events - 1 CVEs
• Com Ewriting - 1 CVEs
• Com Expshop - 1 CVEs
• Com Ezstore - 1 CVEs
• Com Filebase Component - 1 CVEs
• Com Flippingbook - 1 CVEs
• Com Fq - 1 CVEs
• Com Galeria - 1 CVEs
• Com Gallery - 1 CVEs
• Com Gameq - 1 CVEs
• Com Garyscookbook - 1 CVEs
• Com Gsticketsystem - 1 CVEs
• Com Hotproperties - 1 CVEs
• Com Idoblog - 1 CVEs
• Com Imagebrowser - 1 CVEs
• Com Iomezun - 1 CVEs
• Com Jb2 - 1 CVEs
• Com Jokes - 1 CVEs
• Com Joobb - 1 CVEs
• Com Joomradio - 1 CVEs
• Com Jotloader - 1 CVEs
• Com Jvcomment - 1 CVEs
• Com Libros - 1 CVEs
• Com Lms - 1 CVEs
• Com Mamml - 1 CVEs
• Com Marketplace - 1 CVEs
• Com Mcquiz - 1 CVEs
• Com Mediaslide - 1 CVEs
• Com Mezun - 1 CVEs
• Com Mosmedia - 1 CVEs
• Com Musica - 1 CVEs
• Com Mycontent - 1 CVEs
• Com Neogallery - 1 CVEs
• Com Neoreferences - 1 CVEs
• Com News Portal - 1 CVEs
• Com Newsfeeds - 1 CVEs
• Com Newsletter - 1 CVEs
• Com Noticias - 1 CVEs
• Com Paxgallery - 1 CVEs
• Com Profile - 1 CVEs
• Com Quiz - 1 CVEs
• Com Recipes - 1 CVEs
• Com Ricette Component - 1 CVEs
• Com Rssreader - 1 CVEs
• Com Salesrep - 1 CVEs
• Com Scheduling Component - 1 CVEs
• Com School - 1 CVEs
• Com Search - 1 CVEs
• Com Search Component - 1 CVEs
• Com Shambo2 - 1 CVEs
• Com Simpleshop - 1 CVEs
• Com Sobi2 - 1 CVEs
• Com User - 1 CVEs
• Com Waticketsystem - 1 CVEs
• Com Xewebtv - 1 CVEs
• Com Xsstream-dm - 1 CVEs
• Com Ynews - 1 CVEs
• Com Yvcomment - 1 CVEs
• Datsogallery - 1 CVEs
• Easybook Component - 1 CVEs
• Eventlist - 1 CVEs
• Events Module - 1 CVEs
• Expose - 1 CVEs
• Flash Fun Component - 1 CVEs
• Glossary - 1 CVEs
• Hot Properties - 1 CVEs
• Ignitegallery - 1 CVEs
• J Reactions - 1 CVEs
• Jambook - 1 CVEs
• Jd-wordpress - 1 CVEs
• Jim Component - 1 CVEs
• Jim Instant Messaging Component - 1 CVEs
• Joom12pic Component - 1 CVEs
• Joomla Radio - 1 CVEs
• Joomlalib - 1 CVEs
• Kemas Antonius Com Quran - 1 CVEs
• Letterman Subscriber - 1 CVEs
• Lmo - 1 CVEs
• Moslistmessenger Component - 1 CVEs
• Mosmedia - 1 CVEs
• Musepoes Component - 1 CVEs
• Neorecruit - 1 CVEs
• Nfn Address Book - 1 CVEs
• Nice Talk - 1 CVEs
• Pc Cookbook - 1 CVEs
• Performs Component - 1 CVEs
• Pony Gallery - 1 CVEs
• Prince Clan Chess Component - 1 CVEs
• Rapid Recipe - 1 CVEs
• Rsfiles - 1 CVEs
• Rssxt Component - 1 CVEs
• Rwcards Component - 1 CVEs
• Sef4040x - 1 CVEs
• Session - 1 CVEs
• Swmenu Component - 1 CVEs
• Taskhopper Component - 1 CVEs
• Tiny Browser Included With Tinymce 3.0 - 1 CVEs
• Tinybrowser Plugin - 1 CVEs
• Tour De France Pool - 1 CVEs
• Webring Component - 1 CVEs
• X-shop Component - 1 CVEs
• Xstandard - 1 CVEs
• Joomla Cms - 0 CVEs

Newest CVEs of Joomla

• CVE-2026-90915 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache…
• CVE-2026-92226 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-92224 - CVSS 6.7 (medium), 2026-09-29: Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs,…
• CVE-2026-90907 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save…
• CVE-2026-90914 - CVSS 6.4 (medium), 2026-09-29: Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability…
• CVE-2026-92231 - CVSS 7.1 (high), 2026-09-29: Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute…
• CVE-2026-90918 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism,…
• CVE-2026-92222 - CVSS 8.9 (high), 2026-09-29: Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were…
• CVE-2026-92223 - CVSS 5.1 (medium), 2026-09-29: Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-90917 - CVSS 6.9 (medium), 2026-09-29: Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-92225 - CVSS 6.7 (medium), 2026-09-29: Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied…
• CVE-2026-92227 - CVSS 8.2 (high), 2026-09-29: Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an…
• CVE-2026-92232 - CVSS 7.1 (high), 2026-09-29: Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The…
• CVE-2026-90916 - CVSS 5.1 (medium), 2026-09-29: Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows…
• CVE-2026-90913 - CVSS 7 (high), 2026-09-29: Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check…
• CVE-2026-90906 - CVSS 8.3 (high), 2026-09-29: Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link…
• CVE-2026-71573 - CVSS 8.3 (high), 2026-08-18: Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins…
• CVE-2026-72531 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-73336 - CVSS 6.4 (medium), 2026-08-18: Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org…
• CVE-2026-73372 - CVSS 5.1 (medium), 2026-08-18: Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check…
• CVE-2026-71572 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header…
• CVE-2026-73337 - CVSS 8.2 (high), 2026-08-18: Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass…
• CVE-2026-73371 - CVSS 5.1 (medium), 2026-08-18: Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users…
• CVE-2026-72532 - CVSS 5.4 (medium), 2026-08-18: Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-73373 - CVSS 9.8 (critical), 2026-08-18: Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML…
• CVE-2026-71574 - CVSS 8.5 (high), 2026-08-18: Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows…
• CVE-2026-48952 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
• CVE-2026-48947 - CVSS 6.4 (medium), 2026-07-07: An improper access check allows privileged users to overwrite media files without editing permissions.
• CVE-2026-48958 - CVSS 8.8 (high), 2026-07-07: An improper access check allows unauthorized users to create custom fields via webservices endpoints.
• CVE-2026-48950 - CVSS 6.1 (medium), 2026-07-07: Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.