Joomla

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions27
First seenAug 17, 2026
Last mentionedSep 25, 2026

Timeline

27 articles · newest first

[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs

Joomla patches an InputFilter XSS bypass using whitespace in HTML data URIs, CVE-2026-92232.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Advisory 12 sourcesCVE-2026-922322

[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch

Joomla fixes an InputFilter XSS bypass from an HTML5 entity-decoding mismatch, CVE-2026-92231.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Advisory 12 sourcesCVE-2026-922311

[20260914] - Core - MFA Authentication Bypass through rememberme cookies

Joomla remember-me cookies can bypass MFA on CMS 4.0.0–6.1.3; fixed in 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-922271 · 1 read

[20260913] - Core - Improper ACL checks for varous webservice edit tasks

Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-922261 · 1 read

[20260912] - Core - XSS in module list

Unescaped module-list values in Joomla CMS enable XSS; fixed in versions 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-922251 · 1 read

[20260910] - Core - Improper ACL checks for workflow stage changes

Joomla workflow stage changes lack ACL checks on inaccessible content; fixed in 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-922231

[20260909] - Core - SSRF vectors in various core extensions

Joomla fixed high-severity SSRF CVE-2026-92222 in core extensions, patched in CMS 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-922223

[20260908] - Core - XSS in HTML Mail Templates

Joomla patched moderate XSS CVE-2026-90918 in HTML mail templates for CMS 4.x, 5.x, and 6.x.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909181

[20260911] - Core - XSS in link toolbar layout

Joomla fixed moderate XSS CVE-2026-92224 in the link toolbar layout, reported by Google and Ada Logics.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-922241

[20260907] - Core - Improper ACL checks in outputs for tagged items

Joomla patched ACL flaw CVE-2026-90917 that lets users view tagged items in inaccessible categories.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909171 · 1 read

[20260906] - Core - Improper ACL checks in content history comparison view

Joomla patched low-severity CVE-2026-90916, an ACL flaw exposing restricted content history.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909161 · 1 read

[20260905] - Core - Arbitrary directory deletion via cache purge action

Joomla fixed high-severity CVE-2026-90915, a cache-purge path traversal that can delete directories.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909152 · 1 read

[20260904] - Core - XSS in the generic media output layouts

Joomla patched moderate XSS CVE-2026-90914 in generic audio and video media layouts.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909142

[20260903] - Core - Improper ACL checks for access level webservice endpoints

Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909131 · 1 read

[20260902] - Core - Unauthorized user account creation via profile.save controller

Joomla CMS lets unauthenticated users create guest accounts via profile.save when registration is off, fixed in 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 2 sourcesCVE-2026-909071

[20260901] - Core - XSS in HTMLHelper::link method

Joomla HTMLHelper::link lacks output escaping, enabling XSS in CMS 1.5.0-6.1.3; patches are 5.4.9 and 6.1.4.

Joomla Security CentreSep 25, 14:00 UTC · Sep 25, 2026Vulnerability 12 sourcesCVE-2026-909061 · 1 read

[20260810] - Core - Unrestricted uploads of SHTML files

Joomla fixed CVE-2026-73373, an unrestricted SHTML file upload flaw affecting CMS 1.0.0-5.4.7 and 6.0.0-6.1.2 that can enable code execution.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-733734 · 1 read

[20260809] - Core - Improper ACL checks when injection schema.org contact data

Joomla fixed CVE-2026-73372, an improper ACL check that leaks inaccessible contact items' data into schema.org snippets, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-733723 · 1 read

[20260808] - Core - Improper ACL checks for batch copy actions

Joomla fixed CVE-2026-73371, an improper ACL check letting unauthorized users batch-copy uneditable items in Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-733711

[20260807] - Core - MFA Authentication Bypass

Joomla fixed CVE-2026-73337, an MFA authentication bypass caused by insufficient state checks, affecting Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-733371 · 1 read

[20260806] - Core - XSS through schema.org outputs

Joomla fixed CVE-2026-73336, an XSS in schema.org markup outputs caused by improper escaping, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-733362 · 1 read

[20260805] - Core - Improper ACL checks for category webservice endpoints

Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-725321 · 1 read

[20260804] - Core - Improper ACL checks for custom fields webservice endpoints

Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-725311 · 1 read

[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints

Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-715742

[20260802] - Core - Improper CORS origin validation

Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-715731 · 1 read

[20260801] - Core - Response header injection in download views

Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.

Joomla Security CentreAug 17, 14:00 UTC · Aug 17, 2026AdvisoryCVE-2026-715721 · 1 read

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC2

Related CVEs

by mentions

CVE-2026-922228.9
Server-Side Request Forgery (SSRF) in Joomla CMS Core Extensions
published Sep 29, 2026Open Source Matters / Joomla! Project Joomla! CMS (Core extensions)
CVE-2026-909157.0
Path traversal directory deletion in Joomla core
published Sep 29, 2026Joomla! Core
CVE-2026-90907<1%6.9
Unauthorized guest account creation in Joomla core
published Sep 29, 2026Joomla! CorePoC
CVE-2026-909176.9
Improper ACL checks in Joomla tagged-item output
published Sep 29, 2026Joomla! CMS
CVE-2026-909186.9
XSS in Joomla HTML Mail Templates
published Sep 29, 2026Joomla! Core
CVE-2026-909145.9
XSS in Joomla core audio and video media layouts
published Sep 29, 2026Joomla! Core
CVE-2026-73336<1%5.1
Stored XSS via schema.org markup output in Joomla! core 5.1.0–5.4.7 and 6.0.0–6.1.2
published Aug 18, 2026Joomla! CMS
CVE-2026-72532<1%5.1
Improper ACL checks in Joomla! category webservice endpoints
published Aug 18, 2026Joomla! Core
CVE-2026-73371<1%5.1
Improper ACL check enables unauthorized batch copy in Joomla! core
published Aug 18, 2026Joomla! (core)
CVE-2026-71572<1%4.8
Response Header Injection in Joomla! Core Download Views (Reflected File Download)
published Aug 18, 2026Joomla! (core CMS)

Appears with

Joomla CMSproduct · 26
Joomlaorganization · 7
Joomla Security Strike Teamorganization · 6
Ada Logicsorganization · 4
Googleorganization · 4
Joomla Content Editor (JCE)product · 1
Joomla Content Editorvendor · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned Sep 25, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.