Joomla

19 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical9

High10

Medium0

Exploited (KEV)0

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-35223	9.8	critical	joomla\!	An improper access check allows unauthorized access to com_config webservice endpoints.	153d ago
CVE-2026-48902	9.8	critical	joomla\!	The password and username reset features created plain http links for https connections if the "Force SSL" flag wa	153d ago
CVE-2026-48904	9.8	critical	joomla\!	An improper access check allows privelege escalation through the com_users group editing webservice endpoint.	153d ago
CVE-2026-40383	9.8	critical	joomla\!	An improper validation of user-supplied input leads to a local file inclusion vulnerability.	153d ago
CVE-2026-35221	9.8	critical	joomla\!	Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.	153d ago
CVE-2026-73373	9.8	critical	joomla\!	Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default l	69d ago
CVE-2026-35222	9.8	critical	joomla\!	Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.	153d ago
CVE-2026-48898	9.8	critical	joomla\!	An improper access check allows privilege escalation through the com_users batch task.	153d ago
CVE-2026-48899	9.8	critical	joomla\!	An improper access check allows privilege escalation through the com_users batch task.	153d ago
CVE-2026-48957	8.8	high	joomla\!	An improper access check allows unauthorized users to access com_privacy datasets.	111d ago
CVE-2026-48958	8.8	high	joomla\!	An improper access check allows unauthorized users to create custom fields via webservices endpoints.	111d ago
CVE-2026-48948	8.8	high	joomla\!	An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.	111d ago
CVE-2026-71573	8.3	high	joomla\!	Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper imple	69d ago
CVE-2017-20267	8.2	high	calendar planner	Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attac	129d ago
CVE-2026-48901	7.5	high	joomla\!	The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.	153d ago
CVE-2026-48897	7.5	high	joomla\!	Insufficient state checks lead to a vector that allows to bypass 2FA checks.	153d ago
CVE-2026-73337	7.5	high	joomla\!	Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state c	69d ago
CVE-2026-48896	7.5	high	joomla\!	Insufficient state checks lead to a vector that allows to bypass 2FA checks.	153d ago
CVE-2026-40384	7.5	high	joomla\!	An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulne	153d ago

Filter the full tracker by Joomla →

Our coverage of Joomla

CVE-2026-48282Jul 8, 2026critical

U.S. CISA adds Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities affecting Adobe ColdFusion, Joomlack Page Builder, Langflow, and JoomShaper SP Page Builder to its Known Exploited Vulnerabilities (KEV) catalog. This directive mandates that federal agencies patch these vulnerabilities by July 10, 2026, to mitigate risks from active exploitation. Private…

CVE-2026-48282Jul 8, 2026high

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV). These newly identified weaknesses, which affect products from Adobe, Joomla, and Langflow, are reportedly being actively exploited in the wild.