Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
118 results · page 1 of 3
Jul 7, 2026An improper access check allows unauthorized users to create custom fields via webservices endpoints.CVE-2026-48958 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows unauthorized users to create custom fields via webservices endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An improper access check allows unauthorized users to access com_privacy datasets.CVE-2026-48957 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows unauthorized users to access com_privacy datasets.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An improper access check allows users to display a list of modules in the frontend.CVE-2026-48956 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows users to display a list of modules in the frontend.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An improper access check allows unauthorized users to access workflow stage and transition information.CVE-2026-48955 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows unauthorized users to access workflow stage and transition information.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Improper validation leads to a generic XSS vector in the language override feature.CVE-2026-48954 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Improper validation leads to a generic XSS vector in the language override feature.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of escaping leads to an XSS vulnerability in the generic image output layout.CVE-2026-48953 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.CVE-2026-48952 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.CVE-2026-48951 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.CVE-2026-48950 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Lack of validation leads to an XSS vulnerability in the MFA management views.CVE-2026-48949 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of validation leads to an XSS vulnerability in the MFA management views.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.CVE-2026-48948 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An improper access check allows privileged users to overwrite media files without editing permissions.CVE-2026-48947 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows privileged users to overwrite media files without editing permissions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privelege escalation through the com_users group editing webservice endpoint.CVE-2026-48904 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.CVE-2026-48902 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.8
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.CVE-2026-48901 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.CVE-2026-48900 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privilege escalation through the com_users batch task.CVE-2026-48899 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
An improper access check allows privilege escalation through the com_users batch task.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows privilege escalation through the com_users batch task.CVE-2026-48898 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
An improper access check allows privilege escalation through the com_users batch task.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-48897 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2026-48896 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.2
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.CVE-2026-40384 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper validation of user-supplied input leads to a local file inclusion vulnerability.CVE-2026-40383 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026An improper access check allows unauthorized access to com_config webservice endpoints.CVE-2026-35223 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to com_config webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.CVE-2026-35222 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.CVE-2026-35221 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.CVE-2026-35220 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.6
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the readmore links for com_content.CVE-2026-30895 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the content history component.CVE-2026-30894 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the content history component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-25901 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lack of output escaping leads to a XSS vector in the feed modules.CVE-2026-25900 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Lack of output escaping leads to a XSS vector in the feed modules.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026An improper access check allows unauthorized access to webservice endpoints.CVE-2026-23899 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
An improper access check allows unauthorized access to webservice endpoints.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.CVE-2026-23898 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 8.6
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping for article titles leads to XSS vectors in various locations.CVE-2026-21632 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping for article titles leads to XSS vectors in various locations.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-21631 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the multilingual associations component.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.joomla.orggithub.com
Apr 1, 2026Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.CVE-2026-21630 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.9
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026The ajax component was excluded from the default logged-in-user check in the administrative area.CVE-2026-21629 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.3
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63083 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.CVE-2025-63082 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.9
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.CVE-2025-54477 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 5.3
Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-54476 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 4.8
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Insufficient state checks lead to a vector that allows to bypass 2FA checks.CVE-2025-25227 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentiallCVE-2025-22213 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.1
Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.CVE-2025-22207 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.7
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Improper Access Controls allows access to protected views.CVE-2024-40749 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Improper Access Controls allows access to protected views.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Lack of output escaping in the id attribute of menu lists.CVE-2024-40748 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Lack of output escaping in the id attribute of menu lists.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Various module chromes didn't properly process inputs, leading to XSS vectors.CVE-2024-40747 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
Various module chromes didn't properly process inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.CVE-2024-40743 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Improper Access Controls allows backend users to overwrite their username when disallowed.CVE-2024-27187 · Websites & servers · Joomla! Project · reported by security@joomla.orgHigh 7.5
Improper Access Controls allows backend users to overwrite their username when disallowed.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.CVE-2024-27186 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.1
The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.CVE-2024-27185 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.1
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.