Total
669 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-90918 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 5.3 MEDIUM |
| Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | |||||
| CVE-2026-90917 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 5.3 MEDIUM |
| Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view content items from inaccessible categories. | |||||
| CVE-2026-90916 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 2.7 LOW |
| Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to view inaccessible contents. | |||||
| CVE-2026-90915 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.5 MEDIUM |
| Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions. | |||||
| CVE-2026-90914 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 6.4 MEDIUM |
| Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts. | |||||
| CVE-2026-90913 | 1 Joomla | 1 Joomla\! | 2026-10-06 | N/A | 5.5 MEDIUM |
| Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints. | |||||
| CVE-2026-35223 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| An improper access check allows unauthorized access to com_config webservice endpoints. | |||||
| CVE-2026-48897 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 7.5 HIGH |
| Insufficient state checks lead to a vector that allows to bypass 2FA checks. | |||||
| CVE-2026-48902 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. | |||||
| CVE-2026-25901 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 6.1 MEDIUM |
| Lack of output escaping leads to a XSS vector in the multilingual associations component. | |||||
| CVE-2026-48901 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 7.5 HIGH |
| The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key. | |||||
| CVE-2026-48898 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| An improper access check allows privilege escalation through the com_users batch task. | |||||
| CVE-2026-48896 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 7.5 HIGH |
| Insufficient state checks lead to a vector that allows to bypass 2FA checks. | |||||
| CVE-2026-30894 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 6.1 MEDIUM |
| Lack of output escaping leads to a XSS vector in the content history component. | |||||
| CVE-2026-40383 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| An improper validation of user-supplied input leads to a local file inclusion vulnerability. | |||||
| CVE-2026-35221 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. | |||||
| CVE-2026-48903 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 6.1 MEDIUM |
| Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. | |||||
| CVE-2026-48900 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 4.3 MEDIUM |
| An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. | |||||
| CVE-2026-30895 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 6.1 MEDIUM |
| Lack of output escaping leads to a XSS vector in the readmore links for com_content. | |||||
| CVE-2026-40384 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 7.5 HIGH |
| An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. | |||||