Feed live

Joomla vulnerabilities - every known CVE across core and extensions

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Joomla's component-and-module architecture means most disclosed CVEs originate in third-party extensions rather than core. Tracked, scored, and classified as they're published.

Total CVEs tracked

356,133

All time

Critical · Active

12,718

CVSS ≥ 9.0

New · 14 days

2,323

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-35222	medium	6.9/10	Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags	May 26, 2026 4mo ago
CVE-2026-40384	medium	5.9/10	Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint	May 26, 2026 4mo ago
CVE-2026-48905	medium	6.9/10	Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.	May 26, 2026 4mo ago
CVE-2026-48897	high	8.2/10	Joomla! Core - [20260512] - MFA Authentication Bypass	May 26, 2026 4mo ago
CVE-2026-25901	medium	6.9/10	Joomla! Core - [20260502] - XSS in com_associations	May 26, 2026 4mo ago
CVE-2026-48899	medium	5.3/10	Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins	May 26, 2026 4mo ago
CVE-2026-48900	medium	6.4/10	Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler	May 26, 2026 4mo ago
CVE-2026-48902	—	—	Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links	May 26, 2026 4mo ago
CVE-2026-35223	high	8.6/10	Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints	May 26, 2026 4mo ago
CVE-2026-25900	medium	6.9/10	Joomla! Core - [20260501] - XSS in feed modules	May 26, 2026 4mo ago
CVE-2026-48904	high	8.2/10	Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints	May 26, 2026 4mo ago
CVE-2026-30895	medium	6.9/10	Joomla! Core - [20260504] - XSS in readmore links	May 26, 2026 4mo ago
CVE-2026-48898	high	8.2/10	Joomla! Core - [20260513] - Privilege escalation through com_users batch task	May 26, 2026 4mo ago
CVE-2026-30894	medium	6.9/10	Joomla! Core - [20260503] - XSS in com_contenthistory	May 26, 2026 4mo ago
CVE-2026-48901	—	—	Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects	May 26, 2026 4mo ago
CVE-2018-25381	high	7.1/10	Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters	May 25, 2026 4mo ago
CVE-2018-25380	high	7.1/10	Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameters	May 25, 2026 4mo ago
CVE-2018-25354	medium	5.3/10	Joomla Component jomres 9.11.2 Cross-Site Request Forgery	May 23, 2026 4mo ago
CVE-2018-25351	high	8.8/10	Joomla! Component EkRishta 2.10 SQL Injection via username	May 23, 2026 4mo ago
CVE-2018-25348	high	8.8/10	Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail	May 23, 2026 4mo ago
CVE-2018-25337	medium	5.3/10	Joomla JoomOCShop 1.0 Cross-Site Request Forgery	May 17, 2026 5mo ago
CVE-2018-25330	high	8.8/10	Joomla! EkRishta 2.10 Persistent XSS and SQL Injection	May 17, 2026 5mo ago
CVE-2018-25327	medium	6.9/10	Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery	May 17, 2026 5mo ago
CVE-2020-37226	high	7.1/10	Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby	May 13, 2026 5mo ago
CVE-2020-37224	high	7.1/10	Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby	May 13, 2026 5mo ago
CVE-2020-37219	high	8.7/10	Joomla com_fabrik 3.9.11 Directory Traversal via image.php	May 13, 2026 5mo ago
CVE-2020-37218	high	8.8/10	Joomla com_hdwplayer 4.2 SQL Injection via search.php	May 13, 2026 5mo ago
CVE-2026-23900	—	—	Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla	Apr 11, 2026 6mo ago
CVE-2023-54364	medium	5.1/10	Joomla HikaShop 4.7.4 Reflected XSS via Product Filter	Apr 9, 2026 6mo ago
CVE-2023-54363	medium	5.1/10	Joomla Solidres 2.13.3 Reflected XSS via Multiple Parameters	Apr 9, 2026 6mo ago