Joomla security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Joomla. Vendor security advisories are linked on this page.
Built for Operators of this product.
161 public records · 0 security-fix timeline events. 0 published in the last 7 days. 59 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 7
- High 8
- Medium 13
- Low 0
2026-08-0828 issues2026-11-05
Known exploited
View all known exploited- High7.5Joomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 99.97%Oct 29, 2015
- Critical9.8Joomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 99.83%May 17, 2017
- High7.5Joomla! Joomla! Improper Neutralization of Special Elements used in an SQL CommandPatch nowKEVEPSS 94.47%Oct 29, 2015
- Critical10.0JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 88.51%Jun 15, 2026
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityPatch nowKEVEPSS 85.44%Jun 5, 2026
- Critical9.8arkextensions jck_editor Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 82.98%Sep 20, 2018
- Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityPatch nowKEVEPSS 30.87%Jun 27, 2026
- Critical10.0iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 20.07%Jun 20, 2026
Recently published
Browse catalog- Critical10.0Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.55Patch nowKEVEPSS 0.77%Oct 22, 2026
- Medium6.3Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0Check if you run itEPSS 0.27%Oct 5, 2026
- Medium5.3Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0Check if you run itEPSS 0.09%Oct 5, 2026
- Medium6.9Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4Check if you run itEPSS 0.29%Oct 5, 2026
- Medium5.1Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0Check if you run itEPSS 0.10%Oct 5, 2026
- High8.7Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8Check if you run itEPSS 0.37%Oct 5, 2026
- Critical9.3Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16Check if you run itEPSS 0.47%Oct 5, 2026
- Medium6.9Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0Check if you run itEPSS 0.13%Sep 27, 2026
- Critical10.0Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 0.47%Sep 26, 2026
- High8.3Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29Check if you run itEPSS 0.33%Sep 26, 2026