Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

352,138

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,110

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-58077	high	8.7/10	Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2	Jul 15, 2026 2mo ago
CVE-2026-57833	high	8.6/10	Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2	Jul 15, 2026 2mo ago
CVE-2026-57832	high	8.7/10	Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9	Jul 15, 2026 2mo ago
CVE-2026-57831	high	8.7/10	Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2	Jul 15, 2026 2mo ago
CVE-2026-57830	high	8.8/10	Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7	Jul 13, 2026 2mo ago
CVE-2026-57829	high	8.7/10	Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7	Jul 13, 2026 2mo ago
CVE-2026-57827	critical	10.0/10	Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12	Jul 11, 2026 2mo ago
CVE-2026-57828	critical	9.0/10	Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3	Jul 11, 2026 2mo ago
CVE-2026-56292	critical	9.2/10	Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1	Jul 9, 2026 2mo ago
CVE-2026-56291	critical	10.0/10	Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1	Jul 9, 2026 2mo ago
CVE-2026-48952	medium	5.9/10	Joomla! Core - [20260706] - XSS in com_installer	Jul 7, 2026 2mo ago
CVE-2026-48947	medium	6.4/10	Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints	Jul 7, 2026 2mo ago
CVE-2026-48958	medium	6.4/10	Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints	Jul 7, 2026 2mo ago
CVE-2026-48950	medium	5.9/10	Joomla! Core - [20260704] - XSS in com_templates	Jul 7, 2026 2mo ago
CVE-2026-48955	medium	6.4/10	Joomla! Core - [20260709] - Incorrect Access Control in com_workflow	Jul 7, 2026 2mo ago
CVE-2026-48956	medium	6.4/10	Joomla! Core - [20260710] - Incorrect Access Control in com_modules	Jul 7, 2026 2mo ago
CVE-2026-48957	medium	6.4/10	Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints	Jul 7, 2026 2mo ago
CVE-2026-48951	medium	5.9/10	Joomla! Core - [20260705] - XSS in various modalreturn layouts	Jul 7, 2026 2mo ago
CVE-2026-48953	medium	5.9/10	Joomla! Core - [20260707] - XSS in the generic image output layout	Jul 7, 2026 2mo ago
CVE-2026-48948	medium	6.4/10	Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download	Jul 7, 2026 2mo ago
CVE-2026-48949	medium	5.9/10	Joomla! Core - [20260703] - XSS in MFA method management	Jul 7, 2026 2mo ago
CVE-2026-48954	medium	5.9/10	Joomla! Core - [20260708] - XSS through language overrides	Jul 7, 2026 2mo ago
CVE-2026-49049	—	—	Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler	Jun 29, 2026 2mo ago
CVE-2026-56290	critical	10.0/10	Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0	Jun 29, 2026 2mo ago
CVE-2026-49048	high	8.7/10	Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1	Jun 28, 2026 2mo ago
CVE-2026-48945	—	—	Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26	Jun 25, 2026 2mo ago
CVE-2026-48940	—	—	Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26	Jun 25, 2026 2mo ago
CVE-2026-48941	—	—	Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26	Jun 25, 2026 2mo ago
CVE-2026-48946	—	—	Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26	Jun 25, 2026 2mo ago
CVE-2026-48944	—	—	Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26	Jun 25, 2026 2mo ago