JO
CMS
Joomla
On CISA KEVExploited in the wild
420
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 38High 63Medium 149Low 3
Watch
Add Joomla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48958 | 8.8 | Jul 7 | Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints Affected: 4.0.0-5.4.6; 6.0.0-6.1.1 |
| CVE-2026-48957 | 8.8 | Jul 7 | Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints Affected: 4.0.0-5.4.6; 6.0.0-6.1.1 |
| CVE-2026-48948 | 8.8 | Jul 7 | Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download Affected: 3.0.0-5.4.6; 6.0.0-6.1.1 |
| CVE-2026-21630 | 8.8 | Apr 1 | Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint Affected: 4.0.0-5.4.3; 6.0.0-6.0.3 |
| CVE-2026-23899 | 8.8 | Apr 1 | Joomla! Core - [20260306] - Improper access check in webservice endpoints Affected: 4.0.0-5.4.3; 6.0.0-6.0.3 |
| CVE-2020-13760 | 8.8 | Jun 2 | In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF Affected: 3.7.1 before 3.9.19; 3.7.0; 3.7.0; 3.7.0; 3.7.0; 3.7.0; +6 more |
| CVE-2020-10241 | 8.8 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 3.2.0 before 3.9.16 |
| CVE-2020-10239 | 8.8 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 3.7.0 before 3.9.16 |
| CVE-2020-8420 | 8.8 | Jan 28 | An issue was discovered in Joomla! before 3.9.15 Affected: 3.0.0 before 3.9.15 |
| CVE-2020-8419 | 8.8 | Jan 28 | An issue was discovered in Joomla! before 3.9.15 Affected: 3.0.0 before 3.9.15 |
| CVE-2019-18650 | 8.8 | Nov 6 | An issue was discovered in Joomla! before 3.9.13 Affected: 3.2.0 through 3.9.12 |
| CVE-2019-14654 | 8.8 | Aug 5 | In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option Affected: 3.9.7; 3.9.7; 3.9.8 |
| CVE-2018-17858 | 8.8 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 2.5.0 before 3.8.13 |
| CVE-2018-17855 | 8.8 | Oct 9 | An issue was discovered in Joomla! before 3.8.13 Affected: 1.5.0 before 3.8.13 |
| CVE-2018-12712 | 8.8 | Jun 26 | An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9 Affected: 2.5.0 through 3.8.8 |
| CVE-2018-11323 | 8.8 | May 22 | An issue was discovered in Joomla! Core before 3.8.8 Affected: before 3.8.8 |
| CVE-2018-8045 | 8.8 | Mar 15 | In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view Affected: 3.5.0 through 3.8.5 |
| CVE-2017-11364 | 8.8 | Aug 2 | The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by… Affected: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |
| CVE-2026-90906 | 8.3 | Sep 29 | Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 Affected: 1.5.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2026-71573 | 8.3 | Aug 18 | Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 Affected: 4.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2016-8870 | 8.1 | Nov 4 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote… Affected: through 3.6.3 |
| CVE-2026-92222 | 8.0 | Sep 29 | Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2026-92227 | 7.5 | Sep 29 | Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 Affected: 4.0.0-5.4.8; 6.0.0-6.1.3 |
| CVE-2026-73337 | 7.5 | Aug 18 | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 Affected: 4.0.0-5.4.6; 6.0.0-6.1.2 |
| CVE-2026-48896 | 7.5 | May 26 | Joomla! Core - [20260511] - MFA Authentication Bypass Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-40384 | 7.5 | May 26 | Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-48897 | 7.5 | May 26 | Joomla! Core - [20260512] - MFA Authentication Bypass Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2026-48901 | 7.5 | May 26 | Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects Affected: 4.0.0-5.4.5; 6.0.0-6.1.0 |
| CVE-2025-25227 | 7.5 | Apr 8 | Insufficient state checks lead to a vector that allows to bypass 2FA checks Affected: 4.0.0 before 4.4.13; 5.0.0 before 5.2.6 |
| CVE-2024-40749 | 7.5 | Jan 7 | [20250103] - Core - Read ACL violation in multiple core views Affected: 3.9.0-3.10.19; 4.0.0-4.4.9; 5.0.0-5.2.2 |
| CVE-2024-40748 | 7.5 | Jan 7 | [20250102] - Core - XSS vector in the id attribute of menu lists Affected: 3.0.0-3.10.19; 4.0.0-4.4.9; 5.0.0-5.2.2 |
| CVE-2024-27187 | 7.5 | Aug 20 | Improper Access Controls allows backend users to overwrite their username when disallowed Affected: 4.0.0 before 4.4.7; 5.0.0 before 5.1.3 |
| CVE-2023-40626 | 7.5 | Nov 29 | The language file parsing process could be manipulated to expose environment variables Affected: 1.6.0 before 3.10.14; 4.0.0 before 4.4.1; 5.0.0 |
| CVE-2023-23755 | 7.5 | May 30 | An issue was discovered in Joomla! 4.2.0 through 4.3.1 Affected: 4.2.0 before 4.3.2 |
| CVE-2022-23793 | 7.5 | Mar 30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0 Affected: 3.0.0 through 3.10.6; 4.0.0 through 4.1.0 |
| CVE-2021-26038 | 7.5 | Jul 7 | An issue was discovered in Joomla! 2.5.0 through 3.9.27 Affected: 2.5.0 through 3.9.27 |
| CVE-2021-26036 | 7.5 | Jul 7 | An issue was discovered in Joomla! 2.5.0 through 3.9.27 Affected: 2.5.0 through 3.9.27 |
| CVE-2010-1434 | 7.5 | Jun 21 | Joomla! Core is prone to a session fixation vulnerability Affected: 1.5.0 through 1.5.15 |
| CVE-2010-1432 | 7.5 | Jun 21 | Joomla! Core is prone to an information disclosure vulnerability Affected: 1.5.0 through 1.5.15 |
| CVE-2021-23132 | 7.5 | Mar 4 | An issue was discovered in Joomla! 3.0.0 through 3.9.24 Affected: 3.0.0 before 3.9.25 |
| CVE-2021-23131 | 7.5 | Mar 4 | An issue was discovered in Joomla! 3.2.0 through 3.9.24 Affected: 3.2.0 before 3.9.25 |
| CVE-2020-35616 | 7.5 | Dec 28 | An issue was discovered in Joomla! 1.7.0 through 3.9.22 Affected: 1.7.0 through 3.9.22 |
| CVE-2020-35612 | 7.5 | Dec 28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22 Affected: 2.5.0 through 3.9.22 |
| CVE-2020-35611 | 7.5 | Dec 28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22 Affected: 2.5.0 through 3.9.22 |
| CVE-2020-35610 | 7.5 | Dec 28 | An issue was discovered in Joomla! 2.5.0 through 3.9.22 Affected: 2.5.0 through 3.9.22 |
| CVE-2020-13763 | 7.5 | Jun 2 | In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users Affected: 2.5.1 before 3.9.19; 2.5.0; 2.5.0; 2.5.0; 2.5.0 |
| CVE-2020-10238 | 7.5 | Mar 16 | An issue was discovered in Joomla! before 3.9.16 Affected: 2.5.0 before 3.9.16 |
| CVE-2011-4937 | 7.5 | Feb 4 | Joomla! 1.7.1 has core information disclosure due to inadequate error checking Affected: before 1.7.2 |
| CVE-2011-3629 | 7.5 | Feb 4 | Joomla! core 1.7.1 allows information disclosure due to weak encryption Affected: before 1.7.2 |
| CVE-2012-1563 | 7.5 | Jan 15 | Joomla! before 2.5.3 allows Admin Account Creation Affected: before 2.5.3 |