Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

339,646

All time

Critical · Active

10,844

CVSS ≥ 9.0

New · 14 days

2,634

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-48941	—	—	Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26	Jun 25, 2026 22d ago
CVE-2026-48946	—	—	Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26	Jun 25, 2026 22d ago
CVE-2026-48944	—	—	Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26	Jun 25, 2026 22d ago
CVE-2026-48943	—	—	Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26	Jun 25, 2026 22d ago
CVE-2026-48908	critical	10.0/10	Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2	Jun 20, 2026 27d ago
CVE-2026-48939	critical	10.0/10	Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15	Jun 20, 2026 27d ago
CVE-2026-48907	critical	10.0/10	Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5	Jun 5, 2026 1mo ago
CVE-2019-25740	high	7.1/10	Joomla com_jsjobs 1.2.6 Arbitrary File Deletion	Jun 4, 2026 1mo ago
CVE-2018-25433	high	8.8/10	Joomla JE Photo Gallery 1.1 SQL Injection via categoryid	Jun 1, 2026 1mo ago
CVE-2026-48906	critical	9.3/10	Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla	May 27, 2026 1mo ago
CVE-2026-35221	medium	6.9/10	Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder	May 26, 2026 1mo ago
CVE-2026-48903	medium	6.9/10	Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.	May 26, 2026 1mo ago
CVE-2026-48896	high	8.2/10	Joomla! Core - [20260511] - MFA Authentication Bypass	May 26, 2026 1mo ago
CVE-2026-35220	medium	4.6/10	Joomla! Core - [20260505] - CSRF in user activation endpoint	May 26, 2026 1mo ago
CVE-2026-40383	high	7.5/10	Joomla! Core - [20260509] - LFI in HTMLView layout parameter	May 26, 2026 1mo ago
CVE-2026-35222	medium	6.9/10	Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags	May 26, 2026 1mo ago
CVE-2026-40384	medium	5.9/10	Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint	May 26, 2026 1mo ago
CVE-2026-48905	medium	6.9/10	Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.	May 26, 2026 1mo ago
CVE-2026-48897	high	8.2/10	Joomla! Core - [20260512] - MFA Authentication Bypass	May 26, 2026 1mo ago
CVE-2026-25901	medium	6.9/10	Joomla! Core - [20260502] - XSS in com_associations	May 26, 2026 1mo ago
CVE-2026-48899	medium	5.3/10	Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins	May 26, 2026 1mo ago
CVE-2026-48900	medium	6.4/10	Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler	May 26, 2026 1mo ago
CVE-2026-48902	—	—	Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links	May 26, 2026 1mo ago
CVE-2026-35223	high	8.6/10	Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints	May 26, 2026 1mo ago
CVE-2026-25900	medium	6.9/10	Joomla! Core - [20260501] - XSS in feed modules	May 26, 2026 1mo ago
CVE-2026-48904	high	8.2/10	Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints	May 26, 2026 1mo ago
CVE-2026-30895	medium	6.9/10	Joomla! Core - [20260504] - XSS in readmore links	May 26, 2026 1mo ago
CVE-2026-48898	high	8.2/10	Joomla! Core - [20260513] - Privilege escalation through com_users batch task	May 26, 2026 1mo ago
CVE-2026-30894	medium	6.9/10	Joomla! Core - [20260503] - XSS in com_contenthistory	May 26, 2026 1mo ago
CVE-2026-48901	—	—	Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects	May 26, 2026 1mo ago