Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

352,138

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-63683	—	—	Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager	Jul 22, 2026 1mo ago
CVE-2026-64798	—	—	Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension	Jul 22, 2026 1mo ago
CVE-2026-64795	—	—	Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions	Jul 22, 2026 1mo ago
CVE-2026-64792	—	—	Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions	Jul 22, 2026 1mo ago
CVE-2026-63281	—	—	Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager	Jul 22, 2026 1mo ago
CVE-2026-64791	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager	Jul 22, 2026 1mo ago
CVE-2026-63684	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension	Jul 22, 2026 1mo ago
CVE-2026-63264	medium	5.3/10	Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3	Jul 22, 2026 2mo ago
CVE-2026-63048	critical	9.4/10	Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2	Jul 22, 2026 2mo ago
CVE-2026-63047	—	—	Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1	Jul 22, 2026 2mo ago
CVE-2026-62415	—	—	Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2	Jul 21, 2026 2mo ago
CVE-2026-61425	critical	9.4/10	Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0	Jul 20, 2026 2mo ago
CVE-2026-61424	critical	10.0/10	Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2	Jul 20, 2026 2mo ago
CVE-2026-62414	—	—	Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2	Jul 20, 2026 2mo ago
CVE-2026-61900	critical	10.0/10	Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6	Jul 20, 2026 2mo ago
CVE-2026-61901	—	—	Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2	Jul 20, 2026 2mo ago
CVE-2026-60027	high	8.7/10	Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-60031	medium	6.9/10	Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-60029	medium	5.1/10	Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-60026	high	8.9/10	Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-60034	critical	9.4/10	Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0	Jul 20, 2026 2mo ago
CVE-2026-60030	high	8.7/10	Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-60033	medium	5.1/10	Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0	Jul 20, 2026 2mo ago
CVE-2026-60032	critical	9.4/10	Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0	Jul 20, 2026 2mo ago
CVE-2026-60028	high	8.6/10	Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1	Jul 20, 2026 2mo ago
CVE-2026-58148	high	8.7/10	Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52	Jul 17, 2026 2mo ago
CVE-2026-60024	—	—	Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0	Jul 17, 2026 2mo ago
CVE-2026-58149	—	—	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0	Jul 17, 2026 2mo ago
CVE-2026-60025	—	—	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0	Jul 17, 2026 2mo ago
CVE-2026-58078	high	8.7/10	Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1	Jul 16, 2026 2mo ago