Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-65765	medium	6.9/10	Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1	Jul 27, 2026 1mo ago
CVE-2026-65764	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1	Jul 27, 2026 1mo ago
CVE-2026-65762	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0	Jul 23, 2026 1mo ago
CVE-2026-65763	medium	5.1/10	Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4	Jul 23, 2026 1mo ago
CVE-2026-65759	high	8.7/10	Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65761	critical	9.3/10	Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65760	critical	9.2/10	Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1	Jul 23, 2026 1mo ago
CVE-2026-65758	high	8.2/10	Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2	Jul 23, 2026 1mo ago
CVE-2026-65713	—	—	Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension	Jul 23, 2026 1mo ago
CVE-2026-64873	—	—	Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension	Jul 23, 2026 1mo ago
CVE-2026-64871	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension	Jul 23, 2026 1mo ago
CVE-2026-65757	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension	Jul 23, 2026 1mo ago
CVE-2026-65755	—	—	Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension	Jul 23, 2026 1mo ago
CVE-2026-65754	—	—	Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension	Jul 23, 2026 1mo ago
CVE-2026-64875	—	—	Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension	Jul 23, 2026 1mo ago
CVE-2026-64876	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension	Jul 23, 2026 1mo ago
CVE-2026-64872	—	—	Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension	Jul 23, 2026 1mo ago
CVE-2026-65712	—	—	Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension	Jul 23, 2026 1mo ago
CVE-2026-65756	—	—	Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension	Jul 23, 2026 1mo ago
CVE-2026-64874	—	—	Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension	Jul 23, 2026 1mo ago
CVE-2026-64799	—	—	Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions	Jul 23, 2026 1mo ago
CVE-2026-65430	—	—	Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension	Jul 23, 2026 1mo ago
CVE-2026-65431	—	—	Joomla Extension - regularlabs.com - Zipslip in GeoIP extension	Jul 23, 2026 1mo ago
CVE-2026-64793	—	—	Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions	Jul 22, 2026 1mo ago
CVE-2026-64794	—	—	Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions	Jul 22, 2026 1mo ago
CVE-2026-64797	—	—	Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension	Jul 22, 2026 1mo ago
CVE-2026-63265	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints	Jul 22, 2026 1mo ago
CVE-2026-63685	—	—	Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension	Jul 22, 2026 1mo ago
CVE-2026-63280	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager	Jul 22, 2026 1mo ago
CVE-2026-64796	—	—	Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension	Jul 22, 2026 1mo ago