Total
669 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-71572 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 5.4 MEDIUM |
| Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion. | |||||
| CVE-2026-71573 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 8.3 HIGH |
| Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. | |||||
| CVE-2026-73337 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 7.5 HIGH |
| Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks. | |||||
| CVE-2026-73372 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 4.3 MEDIUM |
| Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets. | |||||
| CVE-2026-71574 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 6.5 MEDIUM |
| Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | |||||
| CVE-2026-72532 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 5.4 MEDIUM |
| Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints. | |||||
| CVE-2026-73336 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 6.4 MEDIUM |
| Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs. | |||||
| CVE-2026-73373 | 1 Joomla | 1 Joomla\! | 2026-10-22 | N/A | 9.8 CRITICAL |
| Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution. | |||||
| CVE-2025-63083 | 1 Joomla | 1 Joomla\! | 2026-10-07 | N/A | 6.1 MEDIUM |
| Lack of output escaping leads to a XSS vector in the pagebreak plugin. | |||||
| CVE-2025-63082 | 1 Joomla | 1 Joomla\! | 2026-10-07 | N/A | 6.1 MEDIUM |
| Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags. | |||||
| CVE-2026-90907 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 5.3 MEDIUM |
| Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. | |||||
| CVE-2026-90906 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 8.3 HIGH |
| Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. | |||||
| CVE-2026-92232 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.5 MEDIUM |
| Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector. | |||||
| CVE-2026-92231 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.7 MEDIUM |
| Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector. | |||||
| CVE-2026-92227 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 7.5 HIGH |
| Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability. | |||||
| CVE-2026-92226 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.0 MEDIUM |
| Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items. | |||||
| CVE-2026-92225 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.7 MEDIUM |
| Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector. | |||||
| CVE-2026-92224 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.7 MEDIUM |
| Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector. | |||||
| CVE-2026-92223 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 3.8 LOW |
| Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to update the workflow stage of inaccessible contents. | |||||
| CVE-2026-92222 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 8.0 HIGH |
| Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors. | |||||