Joomla! Project vulnerabilities
Published CVEs affecting Joomla! Project products: 67 record(s), with severity, exploitation and fixes.
CVE-2026-35223
Critical · 9.8
CWE-284 May 26, 2026
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
CVE-2026-35222
Critical · 9.8
CWE-89 May 26, 2026
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
CVE-2026-35221
Critical · 9.8
CWE-89 May 26, 2026
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
CVE-2026-35220
Medium · 4.3
CWE-352 May 26, 2026
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
CVE-2026-30895
Medium · 6.1
CWE-79 May 26, 2026
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
CVE-2026-30894
Medium · 6.1
CWE-79 May 26, 2026
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
CVE-2026-25901
Medium · 6.1
CWE-79 May 26, 2026
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-25900
Medium · 6.1
CWE-79 May 26, 2026
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
CVE-2026-23899
High · 8.8
CWE-284 Apr 1, 2026
Joomla! Core - [20260306] - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints.
CVE-2026-23898
High · 7.2
CWE-73 Apr 1, 2026
Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
CVE-2026-21632
Medium · 5.4
CWE-79 Apr 1, 2026
Joomla! Core - [20260304] - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations.
CVE-2026-21631
Medium · 5.4
CWE-79 Apr 1, 2026
Joomla! Core - [20260303] - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component.
CVE-2026-21630
High · 8.8
CWE-89 Apr 1, 2026
Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
CVE-2026-21629
High · 7.3
CWE-284 Apr 1, 2026
Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
CVE-2025-63083
Medium · 6.1
CWE-79 Jan 6, 2026
Joomla! Core - [20260102] - XSS vector in the pagebreak plugin
Lack of output escaping leads to a XSS vector in the pagebreak plugin.
CVE-2025-63082
Medium · 6.1
CWE-79 Jan 6, 2026
Joomla! Core - [20260101] - Inadequate content filtering for data URLs
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.
CVE-2023-23752
Medium · 5.3
KEV Urgent · 76 Public exploit CWE-284 Feb 16, 2023
Joomla! Improper Access Control Vulnerability
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.