Joomla! Project vulnerabilities
140 CVEs and advisories name Joomla! Project as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-21629Joomla! Core - [20260301] - ACL hardening in com_ajax
- CVE-2026-23899Joomla! Core - [20260306] - Improper access check in webservice endpoints
- CVE-2026-21631Joomla! Core - [20260303] - XSS vector in com_associations comparison view
- CVE-2026-21632Joomla! Core - [20260304] - XSS vectors in various article title outputs
- CVE-2025-63082Joomla! Core - [20260101] - Inadequate content filtering for data URLs
- CVE-2025-63083Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
- CVE-2025-54477Joomla! Core - [20250902] User-Enumeration in passkey authentication method
- CVE-2025-54476Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code
- CVE-2025-25226[20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package
- CVE-2025-25227[20250402] - Joomla Core - MFA Authentication Bypass
- CVE-2025-22213[20250301] - Core - Malicious file uploads via Media Manager
- CVE-2025-22207[20250201] - Core - SQL injection vulnerability in Scheduled Tasks component
- CVE-2024-40749[20250103] - Core - Read ACL violation in multiple core views
- CVE-2024-40747[20250101] - Core - XSS vectors in module chromes
- CVE-2024-40748[20250102] - Core - XSS vector in the id attribute of menu lists
- CVE-2024-27185[20240802] - Core - Cache Poisoning in Pagination
- CVE-2024-27186[20240803] - Core - XSS in HTML Mail Templates
- CVE-2024-27184[20240801] - Core - Inadequate validation of internal URLs
- CVE-2024-40743[20240805] - Core - XSS vectors in Outputfilter::strip* methods
- CVE-2024-27187[20240804] - Core - Improper ACL for backend profile view
- CVE-2024-21729[20240701] - Core - XSS in accessible media selection field
- CVE-2024-21730[20240702] - Core - Self-XSS in fancyselect list field layout
- CVE-2024-26279[20240704] - Core - XSS in Wrapper extensions
- CVE-2024-26278[20240705] - Core - XSS in com_fields default field value
- CVE-2024-21731[20240703] - Core - XSS in StringHelper::truncate method
- CVE-2024-21723[20240202] - Core - Open redirect in installation application
- CVE-2024-21725[20240204] - Core - XSS in mail address outputs
- CVE-2024-21724[20240203] - Core - XSS in media selection fields
- CVE-2024-21722[20240201] - Core - Insufficient session expiration in MFA management views
- CVE-2024-21726[20240205] - Core - Inadequate content filtering within the filter code