Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

344,230

All time

Critical · Active

11,542

CVSS ≥ 9.0

New · 14 days

2,505

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-48952	medium	5.9/10	Joomla! Core - [20260706] - XSS in com_installer	Jul 7, 2026 1mo ago
CVE-2026-48947	medium	6.4/10	Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints	Jul 7, 2026 1mo ago
CVE-2026-48958	medium	6.4/10	Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints	Jul 7, 2026 1mo ago
CVE-2026-48950	medium	5.9/10	Joomla! Core - [20260704] - XSS in com_templates	Jul 7, 2026 1mo ago
CVE-2026-48955	medium	6.4/10	Joomla! Core - [20260709] - Incorrect Access Control in com_workflow	Jul 7, 2026 1mo ago
CVE-2026-48956	medium	6.4/10	Joomla! Core - [20260710] - Incorrect Access Control in com_modules	Jul 7, 2026 1mo ago
CVE-2026-48957	medium	6.4/10	Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints	Jul 7, 2026 1mo ago
CVE-2026-48951	medium	5.9/10	Joomla! Core - [20260705] - XSS in various modalreturn layouts	Jul 7, 2026 1mo ago
CVE-2026-48953	medium	5.9/10	Joomla! Core - [20260707] - XSS in the generic image output layout	Jul 7, 2026 1mo ago
CVE-2026-48948	medium	6.4/10	Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download	Jul 7, 2026 1mo ago
CVE-2026-48949	medium	5.9/10	Joomla! Core - [20260703] - XSS in MFA method management	Jul 7, 2026 1mo ago
CVE-2026-48954	medium	5.9/10	Joomla! Core - [20260708] - XSS through language overrides	Jul 7, 2026 1mo ago
CVE-2026-49049	—	—	Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler	Jun 29, 2026 1mo ago
CVE-2026-56290	critical	10.0/10	Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0	Jun 29, 2026 1mo ago
CVE-2026-49048	high	8.7/10	Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1	Jun 28, 2026 1mo ago
CVE-2026-48945	—	—	Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48940	—	—	Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48941	—	—	Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48946	—	—	Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48944	—	—	Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48943	—	—	Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26	Jun 25, 2026 1mo ago
CVE-2026-48908	critical	10.0/10	Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2	Jun 20, 2026 1mo ago
CVE-2026-48939	critical	10.0/10	Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15	Jun 20, 2026 1mo ago
CVE-2026-48907	critical	10.0/10	Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5	Jun 5, 2026 2mo ago
CVE-2019-25740	high	7.1/10	Joomla com_jsjobs 1.2.6 Arbitrary File Deletion	Jun 4, 2026 2mo ago
CVE-2018-25433	high	8.8/10	Joomla JE Photo Gallery 1.1 SQL Injection via categoryid	Jun 1, 2026 2mo ago
CVE-2026-48906	critical	9.3/10	Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla	May 27, 2026 2mo ago
CVE-2026-35221	medium	6.9/10	Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder	May 26, 2026 2mo ago
CVE-2026-48903	medium	6.9/10	Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.	May 26, 2026 2mo ago
CVE-2026-48896	high	8.2/10	Joomla! Core - [20260511] - MFA Authentication Bypass	May 26, 2026 2mo ago