# Joomla! Project Joomla! CMS.

Every CVE that names Joomla! Project Joomla! CMS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Joomla! Core - \[20260905\] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90915.md)
  `CVE-2026-90915` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal
- [Joomla! Core - \[20260913\] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92226.md)
  `CVE-2026-92226` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260911\] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92224.md)
  `CVE-2026-92224` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260902\] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90907.md)
  `CVE-2026-90907` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260904\] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90914.md)
  `CVE-2026-90914` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260915\] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92231.md)
  `CVE-2026-92231` · CVE record: Joomla! Project Joomla! CMS and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260908\] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90918.md)
  `CVE-2026-90918` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260909\] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92222.md)
  `CVE-2026-92222` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.9 High · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Joomla! Core - \[20260910\] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92223.md)
  `CVE-2026-92223` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260907\] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90917.md)
  `CVE-2026-90917` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260912\] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92225.md)
  `CVE-2026-92225` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260914\] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92227.md)
  `CVE-2026-92227` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Authentication bypass
- [Joomla! Core - \[20260916\] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92232.md)
  `CVE-2026-92232` · CVE record: Joomla! Project Joomla! CMS and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260906\] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90916.md)
  `CVE-2026-90916` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260903\] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90913.md)
  `CVE-2026-90913` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260901\] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90906.md)
  `CVE-2026-90906` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260802\] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-71573.md)
  `CVE-2026-71573` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [Joomla! Core - \[20260804\] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-72531.md)
  `CVE-2026-72531` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Joomla! Core - \[20260806\] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-73336.md)
  `CVE-2026-73336` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260809\] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-73372.md)
  `CVE-2026-73372` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Joomla! Core - \[20260801\] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-71572.md)
  `CVE-2026-71572` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.8 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection
- [Joomla! Core - \[20260807\] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-73337.md)
  `CVE-2026-73337` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 18 Aug 2026 · Tags: Authentication bypass
- [Joomla! Core - \[20260808\] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-73371.md)
  `CVE-2026-73371` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Joomla! Core - \[20260805\] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-72532.md)
  `CVE-2026-72532` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Joomla! Core - \[20260810\] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-73373.md)
  `CVE-2026-73373` · CVE record: Joomla! Project Joomla! CMS and 1 more · CVSS 8.9 High · Not analysed yet · Published 18 Aug 2026 · Tags: Unrestricted file upload
- [Joomla! Core - \[20260803\] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2](https://agentprime.io/advisories/CVE-2026-71574.md)
  `CVE-2026-71574` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control
- [Joomla! Core - \[20260706\] - XSS in com_installer](https://agentprime.io/advisories/CVE-2026-48952.md)
  `CVE-2026-48952` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260701\] - Incorrect Access Control in com_media webservice endpoints](https://agentprime.io/advisories/CVE-2026-48947.md)
  `CVE-2026-48947` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260712\] - Incorrect Access Control in com_fields webservice endpoints](https://agentprime.io/advisories/CVE-2026-48958.md)
  `CVE-2026-48958` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260704\] - XSS in com_templates](https://agentprime.io/advisories/CVE-2026-48950.md)
  `CVE-2026-48950` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260709\] - Incorrect Access Control in com_workflow](https://agentprime.io/advisories/CVE-2026-48955.md)
  `CVE-2026-48955` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260710\] - Incorrect Access Control in com_modules](https://agentprime.io/advisories/CVE-2026-48956.md)
  `CVE-2026-48956` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260711\] - Incorrect Access Control in com_privacy webservice endpoints](https://agentprime.io/advisories/CVE-2026-48957.md)
  `CVE-2026-48957` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260705\] - XSS in various modalreturn layouts](https://agentprime.io/advisories/CVE-2026-48951.md)
  `CVE-2026-48951` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260707\] - XSS in the generic image output layout](https://agentprime.io/advisories/CVE-2026-48953.md)
  `CVE-2026-48953` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260702\] - Incorrect Access Control in com_contact vcf download](https://agentprime.io/advisories/CVE-2026-48948.md)
  `CVE-2026-48948` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Broken access control
- [Joomla! Core - \[20260703\] - XSS in MFA method management](https://agentprime.io/advisories/CVE-2026-48949.md)
  `CVE-2026-48949` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260708\] - XSS through language overrides](https://agentprime.io/advisories/CVE-2026-48954.md)
  `CVE-2026-48954` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260506\] - Authenticated blind SQLi in com_finder](https://agentprime.io/advisories/CVE-2026-35221.md)
  `CVE-2026-35221` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection
- [Joomla! Core - \[20260511\] - MFA Authentication Bypass](https://agentprime.io/advisories/CVE-2026-48896.md)
  `CVE-2026-48896` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass
- [Joomla! Core - \[20260505\] - CSRF in user activation endpoint](https://agentprime.io/advisories/CVE-2026-35220.md)
  `CVE-2026-35220` · CVE record: Joomla! Project Joomla! CMS · CVSS 4.6 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla! Core - \[20260509\] - LFI in HTMLView layout parameter](https://agentprime.io/advisories/CVE-2026-40383.md)
  `CVE-2026-40383` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 26 May 2026 · Tags: Path traversal
- [Joomla! Core - \[20260507\] - Authenticated blind SQLi in com_tags](https://agentprime.io/advisories/CVE-2026-35222.md)
  `CVE-2026-35222` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: SQL injection
- [Joomla! Core - \[20260510\] - Path traversal in com_media webservice endpoint](https://agentprime.io/advisories/CVE-2026-40384.md)
  `CVE-2026-40384` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Path traversal
- [Joomla! Core - \[20260512\] - MFA Authentication Bypass](https://agentprime.io/advisories/CVE-2026-48897.md)
  `CVE-2026-48897` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass
- [Joomla! Core - \[20260502\] - XSS in com_associations](https://agentprime.io/advisories/CVE-2026-25901.md)
  `CVE-2026-25901` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260515\] - Incorrect Access Control in sample data plugins](https://agentprime.io/advisories/CVE-2026-48899.md)
  `CVE-2026-48899` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Joomla! Core - \[20260516\] - Incorrect Access Control in com_scheduler](https://agentprime.io/advisories/CVE-2026-48900.md)
  `CVE-2026-48900` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.4 Medium · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Joomla! Core - \[20260518\] - Transport encryption downgrade for password and username reset links](https://agentprime.io/advisories/CVE-2026-48902.md)
  `CVE-2026-48902` · CVE record: Joomla! Project Joomla! CMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Weak cryptography or TLS
- [Joomla! Core - \[20260508\] - Improper access check in com_config webservice endpoints](https://agentprime.io/advisories/CVE-2026-35223.md)
  `CVE-2026-35223` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Joomla! Core - \[20260501\] - XSS in feed modules](https://agentprime.io/advisories/CVE-2026-25900.md)
  `CVE-2026-25900` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260514\] - Privilege escalation through com_users webservice endpoints](https://agentprime.io/advisories/CVE-2026-48904.md)
  `CVE-2026-48904` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Joomla! Core - \[20260504\] - XSS in readmore links](https://agentprime.io/advisories/CVE-2026-30895.md)
  `CVE-2026-30895` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260513\] - Privilege escalation through com_users batch task](https://agentprime.io/advisories/CVE-2026-48898.md)
  `CVE-2026-48898` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.2 High · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [Joomla! Core - \[20260503\] - XSS in com_contenthistory](https://agentprime.io/advisories/CVE-2026-30894.md)
  `CVE-2026-30894` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site scripting (XSS)
- [Joomla! Core - \[20260517\] - Incorrect Cache Key Construction for InputFilter objects](https://agentprime.io/advisories/CVE-2026-48901.md)
  `CVE-2026-48901` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-524
- [Joomla! Core - \[20260302\] - SQL injection in com_content articles webservice endpoint](https://agentprime.io/advisories/CVE-2026-21630.md)
  `CVE-2026-21630` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: SQL injection
- [Joomla! Core - \[20260305\] - Arbitrary file deletion in com_joomlaupdate](https://agentprime.io/advisories/CVE-2026-23898.md)
  `CVE-2026-23898` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.6 High · Not analysed yet · Published 1 Apr 2026 · Tags: Path traversal
- [Joomla! Core - \[20260301\] - ACL hardening in com_ajax](https://agentprime.io/advisories/CVE-2026-21629.md)
  `CVE-2026-21629` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control
- [Joomla! Core - \[20260306\] - Improper access check in webservice endpoints](https://agentprime.io/advisories/CVE-2026-23899.md)
  `CVE-2026-23899` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.6 High · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control

Older: <https://agentprime.io/advisories/technology/joomla-project-joomla-cms.md?cursor=WyIyMDI2LTA0LTAxVDA5OjAzOjE4LjU2MzAwMFoiLCJDVkUtMjAyNi0yMzg5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=joomla-project-joomla-cms>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/joomla-project-joomla-cms/>. Everything for agents: <https://agentprime.io/llms.txt>.