Skip to contentJoomla! Project vulnerabilities
Newest
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260518] - Transport encryption downgrade for password and username reset linksCVE-2026-48902Fix available9.8 Critical
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260508] - Improper access check in com_config webservice endpointsCVE-2026-35223Public exploitFix availableEPSS 12.8%8.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260501] - XSS in feed modulesCVE-2026-25900Fix available6.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260514] - Privilege escalation through com_users webservice endpointsCVE-2026-48904Fix available8.2 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260504] - XSS in readmore linksCVE-2026-30895Fix available6.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260513] - Privilege escalation through com_users batch taskCVE-2026-48898Fix available8.2 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260503] - XSS in com_contenthistoryCVE-2026-30894Fix available6.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objectsCVE-2026-48901Fix available7.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260302] - SQL injection in com_content articles webservice endpointCVE-2026-21630Fix available6.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdateCVE-2026-23898Fix available8.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260301] - ACL hardening in com_ajaxCVE-2026-21629Fix available6.3 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260306] - Improper access check in webservice endpointsCVE-2026-23899Fix available8.6 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260303] - XSS vector in com_associations comparison viewCVE-2026-21631Fix available5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260304] - XSS vectors in various article title outputsCVE-2026-21632Fix available5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260101] - Inadequate content filtering for data URLsCVE-2025-63082Fix available5.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260102] - XSS vector in the pagebreak pluginCVE-2025-63083Fix available5.9 Medium
- joomla! project cmsJoomla! Core - [20250902] User-Enumeration in passkey authentication methodCVE-2025-544775.3 Medium
- joomla! project cmsJoomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter codeCVE-2025-54476Fix available4.8 Medium
- joomla! project framework, joomla joomla\! +1 more[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database packageCVE-2025-25226Fix available9.8 Critical
- joomla joomla\!, joomla! project cms +1 more[20250402] - Joomla Core - MFA Authentication BypassCVE-2025-25227Public exploitFix available7.5 High
- joomla! project cms[20250301] - Core - Malicious file uploads via Media ManagerCVE-2025-222137.1 High
- joomla! project cms[20250201] - Core - SQL injection vulnerability in Scheduled Tasks componentCVE-2025-222076.7 Medium
- joomla joomla\!, joomla! project cms +1 more[20250103] - Core - Read ACL violation in multiple core viewsCVE-2024-40749Fix available7.5 High
- joomla joomla\!, joomla! project cms +1 more[20250101] - Core - XSS vectors in module chromesCVE-2024-40747Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20250102] - Core - XSS vector in the id attribute of menu listsCVE-2024-40748Fix available7.5 High
- joomial project cms, joomla joomla\! +1 more[20240802] - Core - Cache Poisoning in PaginationCVE-2024-27185Fix available9.1 Critical
- joomla joomla\!, joomla! project cms +1 more[20240803] - Core - XSS in HTML Mail TemplatesCVE-2024-27186Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240801] - Core - Inadequate validation of internal URLsCVE-2024-27184Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240805] - Core - XSS vectors in Outputfilter::strip* methodsCVE-2024-40743Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240804] - Core - Improper ACL for backend profile viewCVE-2024-27187Fix available7.5 High
- joomla joomla\!, joomla! project cms +1 more[20240701] - Core - XSS in accessible media selection fieldCVE-2024-21729Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240702] - Core - Self-XSS in fancyselect list field layoutCVE-2024-21730Fix available5.4 Medium
- joomla joomla\!, joomla! project cms +1 more[20240704] - Core - XSS in Wrapper extensionsCVE-2024-26279Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240705] - Core - XSS in com_fields default field valueCVE-2024-26278Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240703] - Core - XSS in StringHelper::truncate methodCVE-2024-21731Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240202] - Core - Open redirect in installation applicationCVE-2024-21723Fix available4.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20240204] - Core - XSS in mail address outputsCVE-2024-21725Fix availableEPSS 26.8%6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240203] - Core - XSS in media selection fieldsCVE-2024-21724Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240201] - Core - Insufficient session expiration in MFA management viewsCVE-2024-21722Fix available6.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20240205] - Core - Inadequate content filtering within the filter codeCVE-2024-21726Fix availableEPSS 48.8%6.5 Medium
- joomla joomla\!, joomla! project cms +1 more[20231101] - Core - Exposure of environment variablesCVE-2023-40626Public exploitFix available7.5 High
- joomla joomla\!, joomla! project cms +1 more[20230501] - Core - Open Redirect and XSS within the mfa selectCVE-2023-23754Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20230502] - Core - Bruteforce prevention within the mfa screenCVE-2023-23755Fix available7.5 High
- joomla!, joomla joomla\!, joomla! project cms +2 more[20230201] - Core - Improper access check in webservice endpointsCVE-2023-23752In KEVPublic exploitFix availableEPSS 99.8%5.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20230102] - Core - Missing ACL checks for com_actionlogsCVE-2023-237514.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20230101] - Core - CSRF within post-installation messagesCVE-2023-237506.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20221101] - Core - RXSS through reflection of user input in com_mediaCVE-2022-27914Fix available6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20221002] - Core - RXSS through reflection of user input in headingsCVE-2022-27913Public exploit6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20221001] - Core - Debug Mode leaks full request payloads including passwordsCVE-2022-279125.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'CVE-2022-279115.3 Medium
- Show moreLoading…