Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

358,120

All time

Critical · Active

12,890

CVSS ≥ 9.0

New · 14 days

909

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-78074	high	8.8/10	Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions	Aug 31, 2026 2mo ago
CVE-2026-78071	high	7.5/10	Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2	Aug 28, 2026 2mo ago
CVE-2026-78073	medium	5.3/10	Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0	Aug 28, 2026 2mo ago
CVE-2026-78072	high	8.7/10	Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1	Aug 28, 2026 2mo ago
CVE-2026-78070	medium	6.9/10	Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2	Aug 28, 2026 2mo ago
CVE-2026-77991	critical	9.4/10	Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1	Aug 27, 2026 2mo ago
CVE-2026-77034	medium	6.9/10	Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1	Aug 27, 2026 2mo ago
CVE-2026-77990	medium	5.3/10	Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1	Aug 27, 2026 2mo ago
CVE-2026-77035	medium	5.1/10	Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1	Aug 27, 2026 2mo ago
CVE-2026-77989	medium	5.3/10	Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1	Aug 27, 2026 2mo ago
CVE-2026-77998	critical	10.0/10	Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4	Aug 25, 2026 2mo ago
CVE-2026-77995	critical	10.0/10	Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0	Aug 24, 2026 2mo ago
CVE-2026-66917	high	8.6/10	Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0	Aug 22, 2026 2mo ago
CVE-2026-76613	high	8.6/10	Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40	Aug 21, 2026 2mo ago
CVE-2026-77026	medium	6.9/10	Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5	Aug 20, 2026 2mo ago
CVE-2026-76610	medium	6.9/10	Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65	Aug 20, 2026 2mo ago
CVE-2026-75948	high	8.6/10	Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12	Aug 20, 2026 2mo ago
CVE-2026-76564	high	8.6/10	Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7	Aug 20, 2026 2mo ago
CVE-2026-75952	medium	4.6/10	Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3	Aug 19, 2026 2mo ago
CVE-2026-75953	—	—	Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3	Aug 19, 2026 2mo ago
CVE-2026-74803	critical	10.0/10	Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64	Aug 19, 2026 2mo ago
CVE-2026-75114	medium	5.1/10	Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64	Aug 19, 2026 2mo ago
CVE-2026-74804	critical	9.3/10	Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64	Aug 19, 2026 2mo ago
CVE-2026-67364	critical	10.0/10	Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2	Aug 19, 2026 2mo ago
CVE-2026-67363	high	7.7/10	Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2	Aug 19, 2026 2mo ago
CVE-2026-71574	high	8.5/10	Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2	Aug 18, 2026 2mo ago
CVE-2026-74251	critical	9.3/10	Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6	Aug 16, 2026 2mo ago
CVE-2026-67286	medium	6.3/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0	Aug 12, 2026 2mo ago
CVE-2026-67285	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0	Aug 12, 2026 2mo ago
CVE-2026-66915	critical	10.0/10	Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.7	Aug 10, 2026 3mo ago