Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

344,230

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,629

Newly disclosed

Feed last synced

40 mins ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-62415	—	—	Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2	Jul 21, 2026 17d ago
CVE-2026-61425	critical	9.4/10	Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0	Jul 20, 2026 18d ago
CVE-2026-61424	critical	10.0/10	Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2	Jul 20, 2026 18d ago
CVE-2026-62414	—	—	Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2	Jul 20, 2026 18d ago
CVE-2026-61900	critical	10.0/10	Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6	Jul 20, 2026 18d ago
CVE-2026-61901	—	—	Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2	Jul 20, 2026 18d ago
CVE-2026-60027	high	8.7/10	Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-60031	medium	6.9/10	Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-60029	medium	5.1/10	Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-60026	high	8.9/10	Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-60034	critical	9.4/10	Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0	Jul 20, 2026 18d ago
CVE-2026-60030	high	8.7/10	Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-60033	medium	5.1/10	Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0	Jul 20, 2026 18d ago
CVE-2026-60032	critical	9.4/10	Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0	Jul 20, 2026 18d ago
CVE-2026-60028	high	8.6/10	Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1	Jul 20, 2026 18d ago
CVE-2026-58148	high	8.7/10	Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52	Jul 17, 2026 21d ago
CVE-2026-60024	—	—	Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0	Jul 17, 2026 21d ago
CVE-2026-58149	—	—	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0	Jul 17, 2026 21d ago
CVE-2026-60025	—	—	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0	Jul 17, 2026 21d ago
CVE-2026-58078	high	8.7/10	Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1	Jul 16, 2026 23d ago
CVE-2026-58077	high	8.7/10	Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2	Jul 15, 2026 23d ago
CVE-2026-57833	high	8.6/10	Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2	Jul 15, 2026 23d ago
CVE-2026-57832	high	8.7/10	Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9	Jul 15, 2026 24d ago
CVE-2026-57831	high	8.7/10	Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2	Jul 15, 2026 24d ago
CVE-2026-57830	high	8.8/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7	Jul 13, 2026 26d ago
CVE-2026-57829	high	8.7/10	Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7	Jul 13, 2026 26d ago
CVE-2026-57827	critical	10.0/10	Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12	Jul 11, 2026 27d ago
CVE-2026-57828	critical	9.0/10	Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3	Jul 11, 2026 27d ago
CVE-2026-56292	critical	9.2/10	Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1	Jul 9, 2026 29d ago
CVE-2026-56291	critical	10.0/10	Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1	Jul 9, 2026 29d ago