Joomla! Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-48904 An improper access check allows privelege escalation through the com_users group editing webservice endpoint.High 8.2 · May 26, 2026
• CVE-2026-48902 The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.Critical 9.8 · May 26, 2026
• CVE-2026-48901 The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.High 7.5 · May 26, 2026
• CVE-2026-48898 An improper access check allows privilege escalation through the com_users batch task.High 8.2 · May 26, 2026
• CVE-2026-48897 Insufficient state checks lead to a vector that allows to bypass 2FA checks.High 8.2 · May 26, 2026
• CVE-2026-48896 Insufficient state checks lead to a vector that allows to bypass 2FA checks.High 8.2 · May 26, 2026
• CVE-2026-40383 An improper validation of user-supplied input leads to a local file inclusion vulnerability.High 7.5 · May 26, 2026
• CVE-2026-35223 An improper access check allows unauthorized access to com_config webservice endpoints.High 8.6 · May 26, 2026
• CVE-2026-23899 An improper access check allows unauthorized access to webservice endpoints.High 8.6 · Apr 1, 2026
• CVE-2026-23898 Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.High 8.6 · Apr 1, 2026
• CVE-2025-25227 Insufficient state checks lead to a vector that allows to bypass 2FA checks.High 7.5 · Apr 8, 2025
• CVE-2025-25226 Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package.Critical 9.8 · Apr 8, 2025
• CVE-2025-22213 Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentiallHigh 7.1 · Mar 11, 2025
• CVE-2024-40749 Improper Access Controls allows access to protected views.High 7.5 · Jan 7, 2025
• CVE-2024-40748 Lack of output escaping in the id attribute of menu lists.High 7.5 · Jan 7, 2025
• CVE-2024-27187 Improper Access Controls allows backend users to overwrite their username when disallowed.High 7.5 · Aug 20, 2024
• CVE-2024-27185 The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.Critical 9.1 · Aug 20, 2024
• CVE-2023-40626 The language file parsing process could be manipulated to expose environment variables.High 7.5 · Nov 29, 2023
• CVE-2023-23755 An issue was discovered in Joomla! 4.2.0 through 4.3.1.High 7.5 · May 30, 2023
• CVE-2022-23799 An issue was discovered in Joomla! 4.0.0 through 4.1.0.Critical 9.8 · Mar 30, 2022
• CVE-2022-23797 An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0.Critical 9.8 · Mar 30, 2022
• CVE-2022-23795 An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0.Critical 9.8 · Mar 30, 2022
• CVE-2022-23793 An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0.High 7.5 · Mar 30, 2022
• CVE-2021-26040 An issue was discovered in Joomla! 4.0.0.Critical 9.1 · Aug 24, 2021
• CVE-2021-26038 An issue was discovered in Joomla! 2.5.0 through 3.9.27.High 7.5 · Jul 7, 2021