Joomla vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
161 matching records
- Unknown[20260806] - Core - XSS through schema.org outputsCheck if you run itEPSS 0.27%Aug 17, 2026
- Unknown[20260805] - Core - Improper ACL checks for category webservice endpointsCheck if you run itEPSS 0.26%Aug 17, 2026
- Unknown[20260804] - Core - Improper ACL checks for custom fields webservice endpointsCheck if you run itEPSS 0.26%Aug 17, 2026
- Unknown[20260803] - Core - Inconsistent ACL checks for mutating webservice endpointsCheck if you run itEPSS 0.34%Aug 17, 2026
- Unknown[20260802] - Core - Improper CORS origin validationCheck if you run itEPSS 0.34%Aug 17, 2026
- Unknownbalbooa gridbox Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.52%Jul 29, 2026
- Unknownbalbooa gridbox Improper Access ControlPatch nowKEVEPSS 0.52%Jul 29, 2026
- Critical10.0Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 14.85%Jul 8, 2026
- High7.5ollyo helix3 Improper Access ControlPatch nowKEVEPSS 0.99%Jun 29, 2026
- Critical10.0Joomlack Page Builder Improper Access Control VulnerabilityPatch nowKEVEPSS 30.87%Jun 27, 2026
- Critical10.0iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 20.07%Jun 20, 2026
- Critical10.0JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 88.51%Jun 15, 2026
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityPatch nowKEVEPSS 85.44%Jun 5, 2026
- High8.8Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malici…Check if you run itEPSS 0.34%Jun 1, 2026
- Medium6.9Lack of input filtering leads to an XSS vector in the HTML filter code.Check if you run itEPSS 0.15%May 26, 2026
- High8.2An improper access check allows privelege escalation through the com_users group editing webservice endpoint.Check if you run itEPSS 4.58%May 26, 2026
- Medium6.9Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.Check if you run itEPSS 0.15%May 26, 2026
- Critical9.8The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.Check if you run itEPSS 0.25%May 26, 2026
- High7.5The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.Check if you run itEPSS 0.24%May 26, 2026
- Medium6.4An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.Check if you run itEPSS 0.16%May 26, 2026
- Medium5.3An improper access check allows privilege escalation through the com_users batch task.Check if you run itEPSS 0.23%May 26, 2026
- High8.2An improper access check allows privilege escalation through the com_users batch task.Check if you run itEPSS 0.27%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.Check if you run itEPSS 0.21%May 26, 2026
- High8.2Insufficient state checks lead to a vector that allows to bypass 2FA checks.Check if you run itEPSS 0.37%May 26, 2026
- Medium5.9An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.Check if you run itEPSS 0.52%May 26, 2026