Joomla! Project Joomla! CMS
137 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-90915 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | HIGH 7.0 | 0.3 % | ||
| CVE-2026-92226 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | HIGH 7.0 | 0.2 % | ||
| CVE-2026-92224 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-90907 | 1.5.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-90914 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-92231 | 1.5.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 | HIGH 7.1 | 0.3 % | ||
| CVE-2026-90918 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-92222 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | HIGH 8.9 | 0.2 % | ||
| CVE-2026-92223 | 5.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-90917 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-92225 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-92227 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | HIGH 8.2 | 0.3 % | ||
| CVE-2026-92232 | 1.5.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.… | HIGH 7.1 | 0.2 % | ||
| CVE-2026-90916 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-90913 | 4.0.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 | HIGH 7.0 | 0.2 % | ||
| CVE-2026-90906 | 1.5.0-5.4.8 ; 6.0.0-6.1.3 | Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-71573 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-72531 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-73336 | 5.1.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-73372 | 5.1.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-71572 | 3.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-73337 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 | HIGH 8.2 | 0.5 % | ||
| CVE-2026-73371 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-72532 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-73373 | 1.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 | HIGH 8.9 | 0.6 % | ||
| CVE-2026-71574 | 4.0.0-5.4.6 ; 6.0.0-6.1.2 | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 | HIGH 8.5 | 0.3 % | ||
| CVE-2026-48952 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260706] - XSS in com_installer | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-48947 | 4.1.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-48958 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints | MEDIUM 6.4 | 0.5 % | ||
| CVE-2026-48950 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260704] - XSS in com_templates | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-48955 | 6.0.0-6.1.1 | Joomla! Core - [20260709] - Incorrect Access Control in com_workflow | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-48956 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260710] - Incorrect Access Control in com_modules | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-48957 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints | MEDIUM 6.4 | 0.4 % | ||
| CVE-2026-48951 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260705] - XSS in various modalreturn layouts | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-48953 | 4.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260707] - XSS in the generic image output layout | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-48948 | 3.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download | MEDIUM 6.4 | 0.4 % | ||
| CVE-2026-48949 | 4.2.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260703] - XSS in MFA method management | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-48954 | 3.0.0-5.4.6 ; 6.0.0-6.1.1 | Joomla! Core - [20260708] - XSS through language overrides | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-35221 | 6.0.0-6.1.0 ; 5.4.0-5.4.5 | Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-48896 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260511] - MFA Authentication Bypass | HIGH 8.2 | 0.4 % | ||
| CVE-2026-35220 | 6.0.0-6.1.0 | Joomla! Core - [20260505] - CSRF in user activation endpoint | MEDIUM 4.6 | 0.1 % | ||
| CVE-2026-40383 | 3.2.1-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260509] - LFI in HTMLView layout parameter | HIGH 7.5 | 13 % | ||
| CVE-2026-35222 | 6.0.0-6.1.0 ; 4.0.0-5.4.5 | Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-40384 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-48897 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260512] - MFA Authentication Bypass | HIGH 8.2 | 0.2 % | ||
| CVE-2026-25901 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260502] - XSS in com_associations | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-48899 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-48900 | 4.1.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-48902 | 3.9.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-35223 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints | HIGH 8.6 | 13 % | ||
| CVE-2026-25900 | 3.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260501] - XSS in feed modules | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-48904 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints | HIGH 8.2 | 4.6 % | ||
| CVE-2026-30895 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260504] - XSS in readmore links | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-48898 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260513] - Privilege escalation through com_users batch task | HIGH 8.2 | 0.3 % | ||
| CVE-2026-30894 | 3.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260503] - XSS in com_contenthistory | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-48901 | 4.0.0-5.4.5 ; 6.0.0-6.1.0 | Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects | HIGH 7.5 | 0.2 % | ||
| CVE-2026-21630 | 4.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-23898 | 4.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate | HIGH 8.6 | 0.5 % | ||
| CVE-2026-21629 | 3.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260301] - ACL hardening in com_ajax | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-23899 | 4.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260306] - Improper access check in webservice endpoints | HIGH 8.6 | 0.4 % | ||
| CVE-2026-21631 | 4.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260303] - XSS vector in com_associations comparison view | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-21632 | 4.0.0-5.4.3 ; 6.0.0-6.0.3 | Joomla! Core - [20260304] - XSS vectors in various article title outputs | MEDIUM 5.9 | 0.2 % | ||
| CVE-2025-63082 | 4.0.0-5.4.1 ; 6.0.0-6.0.1 | Joomla! Core - [20260101] - Inadequate content filtering for data URLs | MEDIUM 5.9 | 0.2 % | ||
| CVE-2025-63083 | 3.9.0-5.4.1 ; 6.0.0-6.0.1 | Joomla! Core - [20260102] - XSS vector in the pagebreak plugin | MEDIUM 5.9 | 0.2 % | ||
| CVE-2025-54477 | 4.0.0-4.4.13 ; 5.0.0-5.3.3 | Joomla! Core - [20250902] User-Enumeration in passkey authentication method | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-54476 | 3.0.0-3.10.20 ; 4.0.0-4.4.13 ; 5.0.0-5.3.3 | Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-25227 | 4.0.0-4.4.12 ; 5.0.0-5.2.5 | [20250402] - Joomla Core - MFA Authentication Bypass | HIGH 7.5 | 0.4 % | ||
| CVE-2025-22213 | 4.0.0-4.4.11 ; 5.0.0-5.2.4 | [20250301] - Core - Malicious file uploads via Media Manager | HIGH 7.1 | 0.5 % | ||
| CVE-2025-22207 | 4.1.0-4.4.10 ; 5.0.0-5.2.3 | [20250201] - Core - SQL injection vulnerability in Scheduled Tasks component | MEDIUM 6.7 | 0.4 % | ||
| CVE-2024-40749 | 3.9.0-3.10.19 ; 4.0.0-4.4.9 ; 5.0.0-5.2.2 | [20250103] - Core - Read ACL violation in multiple core views | HIGH 7.5 | 0.4 % | ||
| CVE-2024-40747 | 4.0.0-4.4.9 ; 5.0.0-5.2.2 | [20250101] - Core - XSS vectors in module chromes | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-40748 | 3.0.0-3.10.19 ; 4.0.0-4.4.9 ; 5.0.0-5.2.2 | [20250102] - Core - XSS vector in the id attribute of menu lists | HIGH 7.5 | 0.4 % | ||
| CVE-2024-27185 | 3.0.0-3.10.16 ; 4.0.0-4.4.6 ; 5.0.0-5.1.2 | [20240802] - Core - Cache Poisoning in Pagination | CRITICAL 9.1 | 0.4 % | ||
| CVE-2024-27186 | 4.0.0-4.4.6 ; 5.0.0-5.1.2 | [20240803] - Core - XSS in HTML Mail Templates | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-27184 | 3.4.6-3.10.16 ; 4.0.0-4.4.6 ; 5.0.0-5.1.2 | [20240801] - Core - Inadequate validation of internal URLs | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-40743 | 3.0.0-3.10.16 ; 4.0.0-4.4.6 ; 5.0.0-5.1.2 | [20240805] - Core - XSS vectors in Outputfilter::strip* methods | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-27187 | 4.0.0-4.4.6 ; 5.0.0-5.1.2 | [20240804] - Core - Improper ACL for backend profile view | HIGH 7.5 | 0.4 % | ||
| CVE-2024-21729 | 4.0.0-4.4.5 ; 5.0.0-5.1.1 | [20240701] - Core - XSS in accessible media selection field | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-21730 | 4.0.0-4.4.5 ; 5.0.0-5.1.1 | [20240702] - Core - Self-XSS in fancyselect list field layout | MEDIUM 5.4 | 0.4 % | ||
| CVE-2024-26279 | 3.7.0-3.10.15 ; 4.0.0-4.4.5 ; 5.0.0-5.1.1 | [20240704] - Core - XSS in Wrapper extensions | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-26278 | 3.7.0-3.10.15 ; 4.0.0-4.4.5 ; 5.0.0-5.1.1 | [20240705] - Core - XSS in com_fields default field value | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-21731 | 3.0.0-3.10.15 ; 4.0.0-4.4.5 ; 5.0.0-5.1.1 | [20240703] - Core - XSS in StringHelper::truncate method | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-21723 | 1.5.0-3.10.14 ; 4.0.0-4.4.2 ; 5.0.0-5.0.2 | [20240202] - Core - Open redirect in installation application | MEDIUM 4.3 | 0.5 % | ||
| CVE-2024-21725 | 4.0.0-4.4.2 ; 5.0.0-5.0.2 | [20240204] - Core - XSS in mail address outputs | MEDIUM 6.1 | 32 % | ||
| CVE-2024-21724 | 1.6.0-3.10.14 ; 4.0.0-4.4.2 ; 5.0.0-5.0.2 | [20240203] - Core - XSS in media selection fields | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-21722 | 3.2.0-3.10.14 ; 4.0.0-4.4.2 ; 5.0.0-5.0.2 | [20240201] - Core - Insufficient session expiration in MFA management views | MEDIUM 6.3 | 0.5 % | ||
| CVE-2024-21726 | 3.7.0-3.10.14 ; 4.0.0-4.4.2 ; 5.0.0-5.0.2 | [20240205] - Core - Inadequate content filtering within the filter code | MEDIUM 6.5 | 49 % | ||
| CVE-2023-40626 | 1.6.0-4.4.0 ; 5.0.0 | [20231101] - Core - Exposure of environment variables | HIGH 7.5 | 0.8 % | ||
| CVE-2023-23754 | 4.2.0-4.3.1 | [20230501] - Core - Open Redirect and XSS within the mfa select | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-23755 | 4.2.0-4.3.1 | [20230502] - Core - Bruteforce prevention within the mfa screen | HIGH 7.5 | 0.6 % | ||
| CVE-2023-23752 | 4.0.0-4.2.7 | [20230201] - Core - Improper access check in webservice endpoints | MEDIUM 5.3 | 100 % | KEV | |
| CVE-2023-23751 | 4.0.0-4.2.6 | [20230102] - Core - Missing ACL checks for com_actionlogs | MEDIUM 4.3 | 0.4 % | ||
| CVE-2023-23750 | 4.0.0-4.2.6 | [20230101] - Core - CSRF within post-installation messages | MEDIUM 6.3 | 0.2 % | ||
| CVE-2022-27914 | 4.0.0-4.2.4 | [20221101] - Core - RXSS through reflection of user input in com_media | MEDIUM 6.1 | 0.5 % | ||
| CVE-2022-27913 | 4.2.0-4.2.3 | [20221002] - Core - RXSS through reflection of user input in headings | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-27912 | 4.0.0-4.2.3 | [20221001] - Core - Debug Mode leaks full request payloads including passwords | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-27911 | 4.2.0 | [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check' | MEDIUM 5.3 | 0.6 % | ||
| CVE-2022-23801 | 4.0.0-4.1.0 | [20220309] - Core - XSS attack vector through SVG | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-23800 | 4.0.0-4.1.0 | [20220308] - Core - Inadequate content filtering within the filter code | MEDIUM 6.1 | 0.7 % | ||
| CVE-2022-23799 | 4.0.0-4.1.0 | [20220307] - Core - Variable Tampering on JInput $_REQUEST data | CRITICAL 9.8 | 1.2 % | ||
| CVE-2022-23798 | 2.5.0-3.10.6 & 4.0.0-4.1.0 | [20220306] - Core - Inadequate validation of internal URLs | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-23797 | 3.0.0-3.10.6 & 4.0.0-4.1.0 | [20220305] - Core - Inadequate filtering on the selected Ids | CRITICAL 9.8 | 1.1 % | ||
| CVE-2022-23796 | 3.7.0-3.10.6 | [20220304] - Core - Missing input validation within com_fields class inputs | MEDIUM 6.1 | 0.6 % | ||
| CVE-2022-23795 | 2.5.0-3.10.6 & 4.0.0-4.1.0 | [20220303] - Core - User row are not bound to a authentication mechanism | CRITICAL 9.8 | 1.1 % | ||
| CVE-2022-23794 | 3.0.0-3.10.6 & 4.0.0-4.1.0 | [20220302] - Core - Path Disclosure within filesystem error messages | MEDIUM 5.3 | 0.9 % | ||
| CVE-2022-23793 | 3.0.0-3.10.6 & 4.0.0-4.1.0 | [20220301] - Core - Zip Slip within the Tar extractor | HIGH 7.5 | 2.1 % | ||
| CVE-2021-26040 | 4.0.0 | [20210801] - Core - Insufficient access control for com_media deletion endpoint | CRITICAL 9.1 | 0.9 % | ||
| CVE-2021-26039 | 3.0.0-3.9.27 | [20210705] - Core - XSS in com_media imagelist | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-26038 | 2.5.0-3.9.27 | [20210704] - Core - Privilege escalation through com_installer | HIGH 7.5 | 1.0 % | ||
| CVE-2021-26037 | 2.5.0-3.9.27 | [20210703] - Core - Lack of enforced session termination | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-26036 | 2.5.0-3.9.27 | [20210702] - Core - DoS through usergroup table manipulation | HIGH 7.5 | 1.2 % | ||
| CVE-2021-26035 | 3.0.0-3.9.27 | [20210701] - Core - XSS in JForm Rules field | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-26034 | 3.0.0-3.9.26 | [20210503] - Core - CSRF in data download endpoints | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-26033 | 3.0.0-3.9.26 | [20210502] - Core - CSRF in AJAX reordering endpoint | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-26032 | 3.0.0-3.9.26 | [20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-26031 | 3.0.0-3.9.25 | [20210402] - Core - Inadequate filters on module layout settings | MEDIUM 5.3 | 1.0 % | ||
| CVE-2021-26030 | 3.0.0-3.9.25 | [20210401] - Core - Escape xss in logo parameter error pages | MEDIUM 6.1 | 82 % | ||
| CVE-2021-26029 | 1.6.0-3.9.24 | [20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field | MEDIUM 5.3 | 1.0 % | ||
| CVE-2021-26028 | 3.0.0-3.9.24 | [20210308] - Core - Path Traversal within joomla/archive zip class | MEDIUM 5.5 | 1.0 % | ||
| CVE-2021-26027 | 3.0.0-3.9.24 | [20210307] - Core - ACL violation within com_content frontend editing | MEDIUM 5.3 | 1.0 % | ||
| CVE-2021-23132 | 3.0.0-3.9.24 | [20210306] - Core - com_media allowed paths that are not intended for image uploads | HIGH 7.5 | 6.7 % | ||
| CVE-2021-23131 | 3.2.0-3.9.24 | [20210305] - Core - Input validation within the template manager | HIGH 7.5 | 1.4 % | ||
| CVE-2021-23130 | 2.5.0-3.9.24 | [20210304] - Core - XSS within the feed parser library | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-23129 | 2.5.0-3.9.24 | [20210303] - Core - XSS within alert messages showed to users | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-23128 | 3.2.0-3.9.24 | [20210302] - Core - Potential Insecure FOFEncryptRandval | CRITICAL 9.1 | 1.4 % | ||
| CVE-2021-23127 | 3.2.0-3.9.24 | [20210301] - Core - Insecure randomness within 2FA secret generation | CRITICAL 9.1 | 1.4 % | ||
| CVE-2021-23126 | 3.2.0-3.9.24 | [20210301] - Core - Insecure randomness within 2FA secret generation | MEDIUM 5.3 | 1.1 % | ||
| CVE-2021-23125 | 3.1.0-3.9.23 | [20210103] - Core - XSS in com_tags image parameters | MEDIUM 6.1 | 0.8 % | ||
| CVE-2021-23124 | 3.9.0-3.9.23 | [20210102] - Core - XSS in mod_breadcrumbs aria-label attribute | MEDIUM 6.1 | 79 % | ||
| CVE-2021-23123 | 3.0.0-3.9.23 | [20210101] - Core - com_modules exposes module names | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-35616 | 1.7.0 - 3.9.22 | [20201107] - Core - Write ACL violation in multiple core views | HIGH 7.5 | 6.3 % | ||
| CVE-2020-35615 | 2.5.0-3.9.22 | [20201106] - Core - CSRF in com_privacy emailexport feature | MEDIUM 6.3 | 0.4 % | ||
| CVE-2020-35614 | 3.9.0-3.9.22 | [20201105] - Core - User Enumeration in backend login | MEDIUM 5.3 | 1.1 % | ||
| CVE-2020-35613 | 3.0.0-3.9.22 | [20201104] - Core - SQL injection in com_users list view | CRITICAL 9.8 | 29 % | ||
| CVE-2020-35612 | 2.5.0-3.9.22 | [20201103] - Core - Path traversal in mod_random_image | HIGH 7.5 | 1.6 % | ||
| CVE-2020-35611 | 2.5.0-3.9.22 | [20201102] - Core - Disclosure of secrets in Global Configuration page | HIGH 7.5 | 1.3 % | ||
| CVE-2020-35610 | 2.5.0-3.9.22 | [20201101] - Core - com_finder ignores access levels on autosuggest | HIGH 7.5 | 1.4 % |