Login Request a demo
JO
CMS
Joomla
by Joomla · last CVE Sep 29, 2026
On CISA KEVExploited in the wild
422
CVEs
2
On KEV
9.8
Max CVSS
16
New 30D
Vulnerabilities422In the news0Timeline
Severity mix
Critical 38High 63Medium 151Low 3
Severity
All severities422Critical38High63Medium151Low3
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Joomla to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-23752
In wildKEV
5.3
100%
Feb 16
[20230201] - Core - Improper access check in webservice endpoints
Affected: 4.0.0-4.2.7
CVE-2026-92224
6.7
0%
Sep 29
Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Affected: 4.0.0-5.4.8; 6.0.0-6.1.3
CVE-2026-92231
6.7
0%
Sep 29
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Affected: 1.5.0-5.4.8; 6.0.0-6.1.3
CVE-2026-92225
6.7
0%
Sep 29
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Affected: 4.0.0-5.4.8; 6.0.0-6.1.3
CVE-2026-90915
6.5
0%
Sep 29
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Affected: 4.0.0-5.4.8; 6.0.0-6.1.3
CVE-2026-92232
6.5
0%
Sep 29
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
Affected: 1.5.0-5.4.8; 6.0.0-6.1.3
CVE-2026-71574
6.5
0%
Aug 18
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Affected: 4.0.0-5.4.6; 6.0.0-6.1.2
CVE-2026-48955
6.5
0%
Jul 7
Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
Affected: 6.0.0-6.1.1
CVE-2024-21726
6.5
49%
Feb 29
Inadequate content filtering leads to XSS vulnerabilities in various components
Affected: 3.7.0 through 3.10.15; 4.0.0 before 4.4.3; 5.0.0 before 5.0.3
CVE-2021-26034
6.5
0%
May 26
An issue was discovered in Joomla! 3.0.0 through 3.9.26
Affected: 3.0.0 through 3.9.26
CVE-2021-26033
6.5
0%
May 26
An issue was discovered in Joomla! 3.0.0 through 3.9.26
Affected: 3.0.0 through 3.9.26
CVE-2019-12764
6.5
1%
Jun 11
An issue was discovered in Joomla! before 3.9.7
Affected: 3.8.13 before 3.9.7
CVE-2018-11321
6.5
2%
May 22
An issue was discovered in com_fields in Joomla! Core before 3.8.8
Affected: before 3.8.8
CVE-2017-7989
6.5
1%
Apr 25
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden
Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.3.0; +34 more
CVE-2026-90914
6.4
0%
Sep 29
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Affected: 4.0.0-5.4.8; 6.0.0-6.1.3
CVE-2026-73336
6.4
0%
Aug 18
Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2
Affected: 5.1.0-5.4.6; 6.0.0-6.1.2
CVE-2024-21722
6.3
1%
Feb 29
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified
Affected: 3.2.0 before 3.10.15; 4.0.0 before 4.4.3; 5.0.0 before 5.0.3
CVE-2023-23750
6.3
0%
Feb 1
An issue was discovered in Joomla! 4.0.0 through 4.2.6
Affected: 4.0.0 through 4.2.6
CVE-2020-35615
6.3
0%
Dec 28
An issue was discovered in Joomla! 2.5.0 through 3.9.22
Affected: 2.5.0 through 3.9.22
CVE-2020-15700
6.3
1%
Jul 15
An issue was discovered in Joomla! through 3.9.19
Affected: 3.7.0 through 3.9.19
CVE-2020-15695
6.3
1%
Jul 15
An issue was discovered in Joomla! through 3.9.19
Affected: 3.9.0 through 3.9.19
CVE-2026-48952
6.1
0%
Jul 7
Joomla! Core - [20260706] - XSS in com_installer
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48950
6.1
0%
Jul 7
Joomla! Core - [20260704] - XSS in com_templates
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48951
6.1
0%
Jul 7
Joomla! Core - [20260705] - XSS in various modalreturn layouts
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48953
6.1
0%
Jul 7
Joomla! Core - [20260707] - XSS in the generic image output layout
Affected: 4.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48949
6.1
0%
Jul 7
Joomla! Core - [20260703] - XSS in MFA method management
Affected: 4.2.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48954
6.1
0%
Jul 7
Joomla! Core - [20260708] - XSS through language overrides
Affected: 3.0.0-5.4.6; 6.0.0-6.1.1
CVE-2026-48903
6.1
0%
May 26
Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
Affected: 3.0.0 before 5.4.6; 6.0.0 before 6.1.1
CVE-2026-48905
6.1
0%
May 26
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Affected: 3.0.0 before 5.4.6; 6.0.0 before 6.1.0
CVE-2026-25901
6.1
0%
May 26
Joomla! Core - [20260502] - XSS in com_associations
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-25900
6.1
0%
May 26
Joomla! Core - [20260501] - XSS in feed modules
Affected: 3.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-30895
6.1
0%
May 26
Joomla! Core - [20260504] - XSS in readmore links
Affected: 4.0.0-5.4.5; 6.0.0-6.1.0
CVE-2026-30894
6.1
0%
May 26
Joomla! Core - [20260503] - XSS in com_contenthistory
Affected: 3.0.0-5.4.5; 6.0.0-6.1.0
CVE-2025-63082
6.1
0%
Jan 6
Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Affected: 4.0.0-5.4.1; 6.0.0-6.0.1
CVE-2025-63083
6.1
0%
Jan 6
Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
Affected: 3.9.0-5.4.1; 6.0.0-6.0.1
CVE-2024-40747
6.1
0%
Jan 7
[20250101] - Core - XSS vectors in module chromes
Affected: 4.0.0-4.4.9; 5.0.0-5.2.2
CVE-2024-40743
6.1
0%
Aug 20
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors
Affected: 3.0.0 before 3.10.17; 4.0.0 before 4.4.6; 5.0.0 before 5.1.3
CVE-2024-27186
6.1
0%
Aug 20
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions
Affected: 4.0.0 before 4.4.7; 5.0.0 before 5.1.3
CVE-2024-27184
6.1
0%
Aug 20
Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not
Affected: 3.4.6 before 3.10.17; 4.0.0 before 4.4.7; 5.0.0 before 5.1.3
CVE-2024-26279
6.1
0%
Jul 9
The wrapper extensions do not correctly validate inputs, leading to XSS vectors
Affected: 3.0.0 before 3.10.16; 4.0.0 before 4.4.6; 5.0.0 before 5.1.2
CVE-2024-26278
6.1
0%
Jul 9
The Custom Fields component not correctly filter inputs, leading to a XSS vector
Affected: 3.7.0 before 3.10.16; 4.0.0 before 4.4.6; 5.0.0 before 5.1.2
CVE-2024-21731
6.1
0%
Jul 9
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method
Affected: 3.0.0 through 3.10.15; 4.0.0 through 4.4.5; 5.0.0 through 5.1.1
CVE-2024-21729
6.1
0%
Jul 9
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field
Affected: 4.0.0 before 4.4.6; 5.0.0 before 5.1.2
CVE-2024-21725
6.1
32%
Feb 29
Inadequate escaping of mail addresses lead to XSS vulnerabilities in various components
Affected: 4.0.0 before 4.4.3; 5.0.0 before 5.0.3
CVE-2024-21724
6.1
1%
Feb 29
Inadequate input validation for media selection fields lead to XSS vulnerabilities in various extensions
Affected: 1.6.0 before 3.10.15; 4.0.0 before 4.4.3; 5.0.0 before 5.0.3
CVE-2023-23754
6.1
0%
May 30
An issue was discovered in Joomla! 4.2.0 through 4.3.1
Affected: 4.2.0 before 4.3.2
CVE-2022-27914
6.1
1%
Nov 8
An issue was discovered in Joomla! 4.0.0 through 4.2.4
Affected: 4.0.0 before 4.2.5
CVE-2022-27913
6.1
0%
Oct 25
[20221002] - Core - RXSS through reflection of user input in headings
Affected: 4.2.0-4.2.3
CVE-2022-23801
6.1
1%
Mar 30
An issue was discovered in Joomla! 4.0.0 through 4.1.0
Affected: 4.0.0 through 4.1.0
CVE-2022-23800
6.1
1%
Mar 30
An issue was discovered in Joomla! 4.0.0 through 4.1.0
Affected: 4.0.0 through 4.1.0
Page 1 of 4 · 151 total
12…4