CVE Intelligence

Joomla vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Joomla products: 69 record(s), with severity, exploitation and fixes.

Joomla! 68Calendar Planner 1

Exploited only (KEV) →

CVE-2026-71574 Medium · 6.5 CWE-284 Aug 18, 2026
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.
CVE-2026-48958 High · 8.8 CWE-284 Jul 7, 2026
Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints
An improper access check allows unauthorized users to create custom fields via webservices endpoints.
CVE-2026-48957 High · 8.8 CWE-284 Jul 7, 2026
Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints
An improper access check allows unauthorized users to access com_privacy datasets.
CVE-2026-48956 Medium · 5.0 CWE-284 Jul 7, 2026
Joomla! Core - [20260710] - Incorrect Access Control in com_modules
An improper access check allows users to display a list of modules in the frontend.
CVE-2026-48955 Medium · 6.5 CWE-284 Jul 7, 2026
Joomla! Core - [20260709] - Incorrect Access Control in com_workflow
An improper access check allows unauthorized users to access workflow stage and transition information.
CVE-2026-48954 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260708] - XSS through language overrides
Improper validation leads to a generic XSS vector in the language override feature.
CVE-2026-48953 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260707] - XSS in the generic image output layout
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
CVE-2026-48952 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260706] - XSS in com_installer
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
CVE-2026-48951 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260705] - XSS in various modalreturn layouts
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
CVE-2026-48950 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260704] - XSS in com_templates
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
CVE-2026-48949 Medium · 6.1 CWE-79 Jul 7, 2026
Joomla! Core - [20260703] - XSS in MFA method management
Lack of validation leads to an XSS vulnerability in the MFA management views.
CVE-2026-48948 High · 8.8 CWE-284 Jul 7, 2026
Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
CVE-2026-48947 Medium · 4.9 CWE-284 Jul 7, 2026
Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints
An improper access check allows privileged users to overwrite media files without editing permissions.
CVE-2017-20267 High · 8.2 CWE-89 Jun 19, 2026
Joomla! Component Calendar Planner 1.0.1 SQL Injection
Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database information.
CVE-2026-48905 Medium · 6.1 CWE-79 May 26, 2026
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code.
CVE-2026-48904 Critical · 9.8 CWE-284 May 26, 2026
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
CVE-2026-48903 Medium · 6.1 CWE-79 May 26, 2026
Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
CVE-2026-48902 Critical · 9.8 CWE-319 May 26, 2026
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
CVE-2026-48901 High · 7.5 CWE-524 May 26, 2026
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
CVE-2026-48900 Medium · 4.3 CWE-284 May 26, 2026
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
CVE-2026-48899 Critical · 9.8 CWE-284 May 26, 2026
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
An improper access check allows privilege escalation through the com_users batch task.
CVE-2026-48898 Critical · 9.8 CWE-284 May 26, 2026
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
An improper access check allows privilege escalation through the com_users batch task.
CVE-2026-48897 High · 7.5 CWE-287 May 26, 2026
Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVE-2026-48896 High · 7.5 CWE-287 May 26, 2026
Joomla! Core - [20260511] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVE-2026-40384 High · 7.5 CWE-22 May 26, 2026
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.