Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-66491	high	8.2/10	Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 23d ago
CVE-2026-66492	medium	6.1/10	Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 23d ago
CVE-2026-66493	medium	6.4/10	Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 23d ago
CVE-2026-65947	—	—	Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65888	critical	10.0/10	Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65887	critical	10.0/10	Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65890	critical	9.2/10	Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66489	—	—	Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66488	—	—	Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65889	critical	9.2/10	Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66490	—	—	Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65946	—	—	Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0	Jul 29, 2026 1mo ago
CVE-2026-65885	critical	9.4/10	Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65881	—	—	Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1	Jul 28, 2026 1mo ago
CVE-2026-65882	—	—	Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1	Jul 28, 2026 1mo ago
CVE-2026-65876	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65877	high	8.2/10	Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65879	—	—	Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65766	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65878	high	8.3/10	Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65765	medium	6.9/10	Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1	Jul 27, 2026 1mo ago
CVE-2026-65764	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1	Jul 27, 2026 1mo ago
CVE-2026-65762	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0	Jul 23, 2026 1mo ago
CVE-2026-65763	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4	Jul 23, 2026 1mo ago
CVE-2026-65759	high	8.7/10	Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65761	critical	9.3/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65760	critical	9.2/10	Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65758	high	8.2/10	Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2	Jul 23, 2026 1mo ago
CVE-2026-65713	—	—	Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension	Jul 23, 2026 1mo ago
CVE-2026-64873	—	—	Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension	Jul 23, 2026 1mo ago