Joomla! Project Joomla! CMS

• CVE-2026-35223 High 8.6 Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints 12.8%
• CVE-2026-25900 Medium 6.9 Joomla! Core - [20260501] - XSS in feed modules 0.2%
• CVE-2026-48904 High 8.2 Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints 4.6%
• CVE-2026-30895 Medium 6.9 Joomla! Core - [20260504] - XSS in readmore links 0.2%
• CVE-2026-48898 High 8.2 Joomla! Core - [20260513] - Privilege escalation through com_users batch task 0.3%
• CVE-2026-30894 Medium 6.9 Joomla! Core - [20260503] - XSS in com_contenthistory 0.2%
• CVE-2026-48901 High 7.5 Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects 0.2%
• CVE-2026-21630 Medium 6.9 Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint 0.3%
• CVE-2026-23898 High 8.6 Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate 0.5%
• CVE-2026-21629 Medium 6.3 Joomla! Core - [20260301] - ACL hardening in com_ajax 0.3%
• CVE-2026-23899 High 8.6 Joomla! Core - [20260306] - Improper access check in webservice endpoints 0.4%
• CVE-2026-21631 Medium 5.9 Joomla! Core - [20260303] - XSS vector in com_associations comparison view 0.2%
• CVE-2026-21632 Medium 5.9 Joomla! Core - [20260304] - XSS vectors in various article title outputs 0.2%
• CVE-2025-63082 Medium 5.9 Joomla! Core - [20260101] - Inadequate content filtering for data URLs 0.2%
• CVE-2025-63083 Medium 5.9 Joomla! Core - [20260102] - XSS vector in the pagebreak plugin 0.2%
• CVE-2025-54477 Medium 5.3 Joomla! Core - [20250902] User-Enumeration in passkey authentication method 0.3%
• CVE-2025-54476 Medium 4.8 Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code 0.3%
• CVE-2025-25227 High 7.5 [20250402] - Joomla Core - MFA Authentication Bypass 0.4%
• CVE-2025-22213 High 7.1 [20250301] - Core - Malicious file uploads via Media Manager 0.5%
• CVE-2025-22207 Medium 6.7 [20250201] - Core - SQL injection vulnerability in Scheduled Tasks component 0.4%
• CVE-2024-40749 High 7.5 [20250103] - Core - Read ACL violation in multiple core views 0.4%
• CVE-2024-40747 Medium 6.1 [20250101] - Core - XSS vectors in module chromes 0.3%
• CVE-2024-40748 High 7.5 [20250102] - Core - XSS vector in the id attribute of menu lists 0.4%
• CVE-2024-27185 Critical 9.1 [20240802] - Core - Cache Poisoning in Pagination 0.4%
• CVE-2024-27186 Medium 6.1 [20240803] - Core - XSS in HTML Mail Templates 0.3%
• CVE-2024-27184 Medium 6.1 [20240801] - Core - Inadequate validation of internal URLs 0.3%
• CVE-2024-40743 Medium 6.1 [20240805] - Core - XSS vectors in Outputfilter::strip* methods 0.3%
• CVE-2024-27187 High 7.5 [20240804] - Core - Improper ACL for backend profile view 0.4%
• CVE-2024-21729 Medium 6.1 [20240701] - Core - XSS in accessible media selection field 0.4%
• CVE-2024-21730 Medium 5.4 [20240702] - Core - Self-XSS in fancyselect list field layout 0.4%
• CVE-2024-26279 Medium 6.1 [20240704] - Core - XSS in Wrapper extensions 0.5%
• CVE-2024-26278 Medium 4.6 [20240705] - Core - XSS in com_fields default field value 0.4%
• CVE-2024-21731 Medium 6.1 [20240703] - Core - XSS in StringHelper::truncate method 0.4%
• CVE-2024-21723 Medium 4.3 [20240202] - Core - Open redirect in installation application 0.5%
• CVE-2024-21725 Medium 6.1 [20240204] - Core - XSS in mail address outputs 26.8%
• CVE-2024-21724 Medium 6.1 [20240203] - Core - XSS in media selection fields 0.5%
• CVE-2024-21722 Medium 6.3 [20240201] - Core - Insufficient session expiration in MFA management views 0.5%
• CVE-2024-21726 Medium 6.5 [20240205] - Core - Inadequate content filtering within the filter code 48.8%
• CVE-2023-40626 Unrated [20231101] - Core - Exposure of environment variables 0.8%
• CVE-2023-23754 Medium 6.1 [20230501] - Core - Open Redirect and XSS within the mfa select 0.4%
• CVE-2023-23755 High 7.5 [20230502] - Core - Bruteforce prevention within the mfa screen 0.6%
• CVE-2023-23751 Medium 4.3 [20230102] - Core - Missing ACL checks for com_actionlogs 0.4%
• CVE-2023-23750 Medium 6.3 [20230101] - Core - CSRF within post-installation messages 0.2%
• CVE-2022-27914 Unrated [20221101] - Core - RXSS through reflection of user input in com_media 0.6%
• CVE-2022-27913 Unrated [20221002] - Core - RXSS through reflection of user input in headings 0.4%
• CVE-2022-27912 Unrated [20221001] - Core - Debug Mode leaks full request payloads including passwords 0.6%
• CVE-2022-27911 Unrated [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check' 0.6%
• CVE-2022-23801 Unrated [20220309] - Core - XSS attack vector through SVG 0.6%
• CVE-2022-23800 Unrated [20220308] - Core - Inadequate content filtering within the filter code 0.7%
• CVE-2022-23799 Unrated [20220307] - Core - Variable Tampering on JInput $_REQUEST data 1.2%