Joomla! Project Joomla! Cms
121 CVEs affecting Joomla! Project Joomla! Cms. Latest disclosed: 2026-08-18. Critical: 16, High: 26.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48904 | Critical | 9.8 | 2026-05-26 | An improper access check allows privelege escalation through the com_users group editing webservice endpoint. |
CVE-2026-48902 | Critical | 9.8 | 2026-05-26 | The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
CVE-2026-48899 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-48898 | Critical | 9.8 | 2026-05-26 | An improper access check allows privilege escalation through the com_users batch task. |
CVE-2026-40383 | Critical | 9.8 | 2026-05-26 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. |
CVE-2026-35223 | Critical | 9.8 | 2026-05-26 | An improper access check allows unauthorized access to com_config webservice endpoints. |
CVE-2026-35222 | Critical | 9.8 | 2026-05-26 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. |
CVE-2026-35221 | Critical | 9.8 | 2026-05-26 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. |
CVE-2022-23799 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. |
CVE-2022-23797 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an po… |
CVE-2022-23795 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could unde… |
CVE-2020-35613 | Critical | 9.8 | 2020-12-28 | An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injection vulnerability in the backend user lis… |
CVE-2024-27185 | Critical | 9.1 | 2024-08-20 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. |
CVE-2021-26040 | Critical | 9.1 | 2021-08-24 | An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command. |
CVE-2021-23128 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (FOFEncryptRandval) used an potential in… |
CVE-2021-23127 | Critical | 9.1 | 2021-03-04 | An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes. |
CVE-2026-48958 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. |
CVE-2026-48957 | High | 8.8 | 2026-07-07 | An improper access check allows unauthorized users to access com_privacy datasets. |
CVE-2026-48948 | High | 8.8 | 2026-07-07 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. |
CVE-2026-23899 | High | 8.8 | 2026-04-01 | An improper access check allows unauthorized access to webservice endpoints. |