Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-74804	critical	9.3/10	Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64	Aug 19, 2026 1mo ago
CVE-2026-67364	critical	10.0/10	Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2	Aug 19, 2026 1mo ago
CVE-2026-67363	high	7.7/10	Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2	Aug 19, 2026 1mo ago
CVE-2026-71574	high	8.5/10	Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2	Aug 18, 2026 1mo ago
CVE-2026-74251	critical	9.3/10	Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6	Aug 16, 2026 1mo ago
CVE-2026-67286	medium	6.3/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0	Aug 12, 2026 1mo ago
CVE-2026-67285	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0	Aug 12, 2026 1mo ago
CVE-2026-66915	critical	10.0/10	Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.7	Aug 10, 2026 1mo ago
CVE-2026-66914	critical	9.2/10	Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1	Aug 7, 2026 1mo ago
CVE-2026-66494	high	8.7/10	Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0	Aug 7, 2026 1mo ago
CVE-2026-66491	high	8.2/10	Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 1mo ago
CVE-2026-66492	medium	6.1/10	Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 1mo ago
CVE-2026-66493	medium	6.4/10	Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3	Aug 7, 2026 1mo ago
CVE-2026-65947	—	—	Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65888	critical	10.0/10	Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65887	critical	10.0/10	Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65890	critical	9.2/10	Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66489	—	—	Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66488	—	—	Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65889	critical	9.2/10	Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-66490	—	—	Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65946	—	—	Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0	Jul 29, 2026 1mo ago
CVE-2026-65885	critical	9.4/10	Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2	Jul 29, 2026 1mo ago
CVE-2026-65881	—	—	Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1	Jul 28, 2026 1mo ago
CVE-2026-65882	—	—	Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1	Jul 28, 2026 1mo ago
CVE-2026-65876	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65877	high	8.2/10	Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65879	—	—	Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65766	critical	9.2/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago
CVE-2026-65878	high	8.3/10	Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1	Jul 27, 2026 1mo ago