Login Request a demo
JO
CMS
Joomla
by Joomla · last CVE Sep 29, 2026
On CISA KEVExploited in the wild
420
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Vulnerabilities420In the news0Timeline
Severity mix
Critical 38High 63Medium 149Low 3
Severity
All severities420Critical38High63Medium149Low3
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Joomla to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2016-10033
In wildKEV
9.8
100%
Dec 30
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
Affected: 1.5.0 through 3.6.5
CVE-2023-23752
In wildKEV
5.3
100%
Feb 16
[20230201] - Core - Improper access check in webservice endpoints
Affected: 4.0.0-4.2.7
CVE-2026-73373
9.8
1%
Aug 18
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
Affected: 1.0.0-5.4.6; 6.0.0-6.1.2
CVE-2026-35221
9.8
0%
May 26
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
Affected: 6.0.0-6.1.0; 5.4.0-5.4.5
CVE-2026-40383
9.8
13%
May 26
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
Affected: 3.2.1-5.4.5; 6.0.0-6.1.0
CVE-2026-35222
9.8
0%
May 26
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Affected: 6.0.0-6.1.0; 4.0.0-5.4.5
CVE-2026-48899
9.8
0%
May 26
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-48902
9.8
0%
May 26
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
Affected: 3.9.0-5.4.5; 6.0.0-6.1.0
CVE-2026-35223
9.8
13%
May 26
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-48904
9.8
5%
May 26
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-48898
9.8
0%
May 26
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2025-25226
9.8
0%
Apr 8
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package
Affected: 1.0.0 before 2.2.0; 3.0.0 before 3.4.0
CVE-2022-23799
9.8
1%
Mar 30
An issue was discovered in Joomla! 4.0.0 through 4.1.0
Affected: 4.0.0 through 4.1.0
CVE-2022-23797
9.8
1%
Mar 30
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0
Affected: 3.0.0 through 3.10.6; 4.0.0 through 4.1.0
CVE-2022-23795
9.8
1%
Mar 30
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0
Affected: 2.5.0 through 3.10.6; 4.0.0 through 4.1.0
CVE-2010-1435
9.8
1%
Jun 21
Joomla! Core is prone to a security bypass vulnerability
Affected: 1.5.0 through 1.5.15
CVE-2010-1433
9.8
1%
Jun 21
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input
Affected: 1.5.0 through 1.5.15
CVE-2020-35613
9.8
29%
Dec 28
An issue was discovered in Joomla! 3.0.0 through 3.9.22
Affected: 3.0.0 through 3.9.22
CVE-2020-10243
9.8
2%
Mar 16
An issue was discovered in Joomla! before 3.9.16
Affected: 1.7.0 before 3.9.16
CVE-2019-19846
9.8
2%
Dec 18
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors
Affected: 2.5.0 through 3.9.14
CVE-2019-12765
9.8
10%
Jun 11
An issue was discovered in Joomla! before 3.9.7
Affected: 3.9.0 through 3.9.6
CVE-2019-11831
9.8
5%
May 9
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a…
Affected: 3.9.3 through 3.9.5
CVE-2019-10945
9.8
40%
Apr 10
An issue was discovered in Joomla! before 3.9.5
Affected: 1.5.0 through 3.9.4
CVE-2019-7743
9.8
3%
Feb 12
An issue was discovered in Joomla! before 3.9.3
Affected: 2.5.0 through 3.9.2
CVE-2018-15882
9.8
3%
Aug 29
An issue was discovered in Joomla! before 3.8.12
Affected: before 3.8.12
CVE-2018-11325
9.8
3%
May 22
An issue was discovered in Joomla! Core before 3.8.8
Affected: before 3.8.8
CVE-2018-6376
9.8
4%
Jan 30
In Joomla! before 3.8.4, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Hathor postinstall message
Affected: before 3.8.4
CVE-2017-16634
9.8
4%
Nov 10
In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method
Affected: 3.2.0 through 3.8.1
CVE-2017-14596
9.8
7%
Sep 20
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password
Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +34 more
CVE-2017-8917
9.8
100%
May 17
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors
Affected: 3.7.0
CVE-2016-9081
9.8
2%
Jan 23
Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors
Affected: 3.4.4; 3.4.5; 3.4.6; 3.4.7; 3.4.8; 3.4.8; +27 more
CVE-2016-10045
9.8
98%
Dec 30
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging…
Affected: 1.5.0 through 3.6.5
CVE-2016-9836
9.8
2%
Dec 5
The file scanning mechanism of JFilterInput::isFileSafe() in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP…
Affected: through 3.6.4
CVE-2016-8869
9.8
97%
Nov 4
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by…
Affected: through 3.6.3
CVE-2024-27185
9.1
0%
Aug 20
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors
Affected: 3.0.0 before 3.10.17; 4.0.0 before 4.4.7; 5.0.0 before 5.1.3
CVE-2021-26040
9.1
1%
Aug 24
An issue was discovered in Joomla! 4.0.0
Affected: 4.0.0
CVE-2021-23128
9.1
1%
Mar 4
An issue was discovered in Joomla! 3.2.0 through 3.9.24
Affected: 3.2.0 before 3.9.25
CVE-2021-23127
9.1
1%
Mar 4
An issue was discovered in Joomla! 3.2.0 through 3.9.24
Affected: 3.2.0 before 3.9.25
CVE-2011-1151
9.1
2%
Feb 5
Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters
Affected: 1.6.0
CVE-2026-48958
8.8
0%
Jul 7
Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48957
8.8
0%
Jul 7
Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48948
8.8
0%
Jul 7
Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
Affected: 3.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-21630
8.8
0%
Apr 1
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Affected: 4.0.0-5.4.3; 6.0.0-6.0.3
CVE-2026-23899
8.8
0%
Apr 1
Joomla! Core - [20260306] - Improper access check in webservice endpoints
Affected: 4.0.0-5.4.3; 6.0.0-6.0.3
CVE-2020-13760
8.8
1%
Jun 2
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF
Affected: 3.7.1 before 3.9.19; 3.7.0; 3.7.0; 3.7.0; 3.7.0; 3.7.0; +6 more
CVE-2020-10241
8.8
1%
Mar 16
An issue was discovered in Joomla! before 3.9.16
Affected: 3.2.0 before 3.9.16
CVE-2020-10239
8.8
3%
Mar 16
An issue was discovered in Joomla! before 3.9.16
Affected: 3.7.0 before 3.9.16
CVE-2020-8420
8.8
1%
Jan 28
An issue was discovered in Joomla! before 3.9.15
Affected: 3.0.0 before 3.9.15
CVE-2020-8419
8.8
0%
Jan 28
An issue was discovered in Joomla! before 3.9.15
Affected: 3.0.0 before 3.9.15
CVE-2019-18650
8.8
0%
Nov 6
An issue was discovered in Joomla! before 3.9.13
Affected: 3.2.0 through 3.9.12
Page 1 of 9 · 420 total
12…9