Joomla! Project vulnerabilities
140 CVEs and advisories name Joomla! Project as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-48955Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
- CVE-2026-48956Joomla! Core - [20260710] - Incorrect Access Control in com_modules
- CVE-2026-48957Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
- CVE-2026-48951Joomla! Core - [20260705] - XSS in various modalreturn layouts
- CVE-2026-48953Joomla! Core - [20260707] - XSS in the generic image output layout
- CVE-2026-48948Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
- CVE-2026-48949Joomla! Core - [20260703] - XSS in MFA method management
- CVE-2026-48954Joomla! Core - [20260708] - XSS through language overrides
- CVE-2026-35221Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
- CVE-2026-48903Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
- CVE-2026-48896Joomla! Core - [20260511] - MFA Authentication Bypass
- CVE-2026-35220Joomla! Core - [20260505] - CSRF in user activation endpoint
- CVE-2026-40383Joomla! Core - [20260509] - LFI in HTMLView layout parameter
- CVE-2026-35222Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
- CVE-2026-40384Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
- CVE-2026-48905Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
- CVE-2026-48897Joomla! Core - [20260512] - MFA Authentication Bypass
- CVE-2026-25901Joomla! Core - [20260502] - XSS in com_associations
- CVE-2026-48899Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
- CVE-2026-48900Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
- CVE-2026-48902Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
- CVE-2026-35223Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
- CVE-2026-25900Joomla! Core - [20260501] - XSS in feed modules
- CVE-2026-48904Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
- CVE-2026-30895Joomla! Core - [20260504] - XSS in readmore links
- CVE-2026-48898Joomla! Core - [20260513] - Privilege escalation through com_users batch task
- CVE-2026-30894Joomla! Core - [20260503] - XSS in com_contenthistory
- CVE-2026-48901Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
- CVE-2026-21630Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
- CVE-2026-23898Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate