[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs
Joomla patches an InputFilter XSS bypass using whitespace in HTML data URIs, CVE-2026-92232.
36
Product
Joomla CMS
- Mentions · 7d0
- Mentions · 30d0
- All mentions26
- First seenAug 17, 2026
- Last mentionedSep 25, 2026
Timeline
26 articles · newest first[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch
Joomla fixes an InputFilter XSS bypass from an HTML5 entity-decoding mismatch, CVE-2026-92231.
34
[20260914] - Core - MFA Authentication Bypass through rememberme cookies
Joomla remember-me cookies can bypass MFA on CMS 4.0.0–6.1.3; fixed in 5.4.9 and 6.1.4.
46
[20260913] - Core - Improper ACL checks for varous webservice edit tasks
Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.
38
[20260912] - Core - XSS in module list
Unescaped module-list values in Joomla CMS enable XSS; fixed in versions 5.4.9 and 6.1.4.
28
[20260910] - Core - Improper ACL checks for workflow stage changes
Joomla workflow stage changes lack ACL checks on inaccessible content; fixed in 5.4.9 and 6.1.4.
24
[20260909] - Core - SSRF vectors in various core extensions
Joomla fixed high-severity SSRF CVE-2026-92222 in core extensions, patched in CMS 5.4.9 and 6.1.4.
55
[20260908] - Core - XSS in HTML Mail Templates
Joomla patched moderate XSS CVE-2026-90918 in HTML mail templates for CMS 4.x, 5.x, and 6.x.
42
[20260911] - Core - XSS in link toolbar layout
Joomla fixed moderate XSS CVE-2026-92224 in the link toolbar layout, reported by Google and Ada Logics.
38
[20260907] - Core - Improper ACL checks in outputs for tagged items
Joomla patched ACL flaw CVE-2026-90917 that lets users view tagged items in inaccessible categories.
32
[20260906] - Core - Improper ACL checks in content history comparison view
Joomla patched low-severity CVE-2026-90916, an ACL flaw exposing restricted content history.
28
[20260905] - Core - Arbitrary directory deletion via cache purge action
Joomla fixed high-severity CVE-2026-90915, a cache-purge path traversal that can delete directories.
58
[20260904] - Core - XSS in the generic media output layouts
Joomla patched moderate XSS CVE-2026-90914 in generic audio and video media layouts.
40
[20260903] - Core - Improper ACL checks for access level webservice endpoints
Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.
48
[20260902] - Core - Unauthorized user account creation via profile.save controller
Joomla CMS lets unauthenticated users create guest accounts via profile.save when registration is off, fixed in 5.4.9 and 6.1.4.
44
[20260901] - Core - XSS in HTMLHelper::link method
Joomla HTMLHelper::link lacks output escaping, enabling XSS in CMS 1.5.0-6.1.3; patches are 5.4.9 and 6.1.4.
34
[20260810] - Core - Unrestricted uploads of SHTML files
Joomla fixed CVE-2026-73373, an unrestricted SHTML file upload flaw affecting CMS 1.0.0-5.4.7 and 6.0.0-6.1.2 that can enable code execution.
38
[20260809] - Core - Improper ACL checks when injection schema.org contact data
Joomla fixed CVE-2026-73372, an improper ACL check that leaks inaccessible contact items' data into schema.org snippets, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
24
[20260808] - Core - Improper ACL checks for batch copy actions
Joomla fixed CVE-2026-73371, an improper ACL check letting unauthorized users batch-copy uneditable items in Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.
24
[20260807] - Core - MFA Authentication Bypass
Joomla fixed CVE-2026-73337, an MFA authentication bypass caused by insufficient state checks, affecting Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.
42
[20260806] - Core - XSS through schema.org outputs
Joomla fixed CVE-2026-73336, an XSS in schema.org markup outputs caused by improper escaping, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
30
[20260805] - Core - Improper ACL checks for category webservice endpoints
Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.
25
[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
22
[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.
35
[20260802] - Core - Improper CORS origin validation
Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.
28
[20260801] - Core - Response header injection in download views
Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.
18
Related CVEs
by mentions- Server-Side Request Forgery (SSRF) in Joomla CMS Core Extensions
- Path traversal directory deletion in Joomla core
- CVE-2026-90907<1%6.9Unauthorized guest account creation in Joomla core
- Improper ACL checks in Joomla tagged-item output
- XSS in Joomla HTML Mail Templates
- XSS in Joomla core audio and video media layouts
- CVE-2026-73336<1%5.1Stored XSS via schema.org markup output in Joomla! core 5.1.0–5.4.7 and 6.0.0–6.1.2
- CVE-2026-72532<1%5.1Improper ACL checks in Joomla! category webservice endpoints
- CVE-2026-73371<1%5.1Improper ACL check enables unauthorized batch copy in Joomla! core
- CVE-2026-71572<1%4.8Response Header Injection in Joomla! Core Download Views (Reflected File Download)
Appears with
- Joomlavendor · 26
- Joomlaorganization · 7
- Joomla Security Strike Teamorganization · 6
- Ada Logicsorganization · 4
- Googleorganization · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.