Advisories · Technology
Joomla! Project Joomla! CMS.
Every CVE that names Joomla! Project Joomla! CMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.0 High
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Path traversal
- CVSS 7.0 High
Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Joomla! Project Joomla! Framework Filter package
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 8.9 High
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.9 Medium
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 8.2 High
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Authentication bypass
- CVSS 7.1 High
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Joomla! Project Joomla! Framework Filter package
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 7.0 High
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Other injection
- CVSS 5.1 Medium
Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.1 Medium
Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 4.8 Medium
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Other injection
- CVSS 8.2 High
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Authentication bypass
- CVSS 5.1 Medium
Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.1 Medium
Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 8.9 High
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Joomla! Project Joomla! Framework Filesystem package
- Unrestricted file upload
- CVSS 8.5 High
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260706] - XSS in com_installer
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.4 Medium
Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260704] - XSS in com_templates
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.4 Medium
Joomla! Core - [20260710] - Incorrect Access Control in com_modules
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.4 Medium
Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260705] - XSS in various modalreturn layouts
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260707] - XSS in the generic image output layout
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 5.9 Medium
Joomla! Core - [20260703] - XSS in MFA method management
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Joomla! Core - [20260708] - XSS through language overrides
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
- Joomla! Project Joomla! CMS
- SQL injection
- CVSS 8.2 High
Joomla! Core - [20260511] - MFA Authentication Bypass
- Joomla! Project Joomla! CMS
- Authentication bypass
- CVSS 4.6 Medium
Joomla! Core - [20260505] - CSRF in user activation endpoint
- Joomla! Project Joomla! CMS
- Cross-site request forgery (CSRF)
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
- Joomla! Project Joomla! CMS
- Path traversal
- CVSS 6.9 Medium
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
- Joomla! Project Joomla! CMS
- SQL injection
- CVSS 5.9 Medium
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
- Joomla! Project Joomla! CMS
- Path traversal
- CVSS 8.2 High
Joomla! Core - [20260512] - MFA Authentication Bypass
- Joomla! Project Joomla! CMS
- Authentication bypass
- CVSS 6.9 Medium
Joomla! Core - [20260502] - XSS in com_associations
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.4 Medium
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- Joomla! Project Joomla! CMS
- Weak cryptography or TLS
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.9 Medium
Joomla! Core - [20260501] - XSS in feed modules
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 8.2 High
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.9 Medium
Joomla! Core - [20260504] - XSS in readmore links
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 8.2 High
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 6.9 Medium
Joomla! Core - [20260503] - XSS in com_contenthistory
- Joomla! Project Joomla! CMS
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
- Joomla! Project Joomla! CMS
- CWE-524
- CVSS 6.9 Medium
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
- Joomla! Project Joomla! CMS
- SQL injection
- CVSS 8.6 High
Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
- Joomla! Project Joomla! CMS
- Path traversal
- CVSS 6.3 Medium
Joomla! Core - [20260301] - ACL hardening in com_ajax
- Joomla! Project Joomla! CMS
- Broken access control
- CVSS 8.6 High
Joomla! Core - [20260306] - Improper access check in webservice endpoints
- Joomla! Project Joomla! CMS
- Broken access control