35
60
60
60
60
60
47
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero
60
57
57
60
60
60
60
60
60
60
[webapps] Joomla JCE_2.9.15 - Remote Code Execution
A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.
Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.
40
35
[20260808] - Core - Improper ACL checks for batch copy actions
Joomla fixed CVE-2026-73371, an improper ACL check letting unauthorized users batch-copy uneditable items in Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260808 describes CVE-2026-73371, an incorrect access control issue in batch copy actions. The flaw allows unauthorized users to perform copy batch operations on items they cannot edit. Affected versions are 4.0.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Sabuhi Mammadov on 2026-07-28.
24
[20260807] - Core - MFA Authentication Bypass
Joomla fixed CVE-2026-73337, an MFA authentication bypass caused by insufficient state checks, affecting Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260807 describes CVE-2026-73337, an authentication bypass in Joomla CMS multi-factor authentication. Insufficient state checks create a vector that allows 2FA checks to be bypassed; the vendor rates the impact as high with moderate probability. Affected versions are 4.0.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by bloman and Matej Rada on 2026-07-25.
42
30
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
60
30
[20260810] - Core - Unrestricted uploads of SHTML files
Joomla fixed CVE-2026-73373, an unrestricted SHTML file upload flaw affecting CMS 1.0.0-5.4.7 and 6.0.0-6.1.2 that can enable code execution.
Joomla published security advisory 20260810 for CVE-2026-73373, an unrestricted upload of files with dangerous type in Joomla CMS. The default dangerous-file list omitted SHTML files, which could lead to code execution on servers that execute SHTML. Affected versions are 1.0.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Valentin Lobstein (Chocapikk) on 2026-07-29.
38
[20260809] - Core - Improper ACL checks when injection schema.org contact data
Joomla fixed CVE-2026-73372, an improper ACL check that leaks inaccessible contact items' data into schema.org snippets, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260809 describes CVE-2026-73372, an incorrect access control issue when injecting schema.org contact data. Improper access checks inject contact information for inaccessible contact items into schema.org snippets, exposing restricted data. Affected versions are 5.1.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Stefan Wendhausen on 2026-07-31.
24
[20260806] - Core - XSS through schema.org outputs
Joomla fixed CVE-2026-73336, an XSS in schema.org markup outputs caused by improper escaping, affecting CMS 5.1.0-5.4.7 and 6.0.0-6.1.2.
Joomla security advisory 20260806 describes CVE-2026-73336, a cross-site scripting issue in schema.org markup outputs. Improper escaping flags create an XSS vector in schema.org output; the vendor rates impact and severity as moderate with low probability. Affected versions are 5.1.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Amin Isayev and Geo (GitHub.com/geo-chen) on 2026-07-21.
30
[20260805] - Core - Improper ACL checks for category webservice endpoints
Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.
Joomla disclosed an incorrect access control flaw (CVE-2026-72532) in category webservice endpoints, allowing unauthorized users to create categories for inaccessible components. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 and is rated moderate impact and severity with low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18; it was reported by Amin Isayev and Geo.
25
[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
Joomla disclosed an incorrect access control issue (CVE-2026-72531) letting unauthorized users create custom fields for inaccessible components through webservice endpoints. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, rated moderate impact and severity with low probability. Fixed in Joomla 5.4.8 and 6.1.3; reported by ebadfd on 2026-07-06.
22
[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.
Joomla disclosed an inconsistent access control flaw (CVE-2026-71574) in mutating webservice endpoints, where unauthorized users could perform mutations restricted in the backend UI; impact is rated high. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2, with moderate severity and low probability. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.
35
[20260802] - Core - Improper CORS origin validation
Joomla patches CVE-2026-71573, improper CORS origin validation in CMS requests, in versions 5.4.8 and 6.1.3.
Joomla disclosed improper CORS origin validation (CVE-2026-71573), where configured CORS origins were not properly validated on CORS requests, rated moderate impact/severity and moderate probability. It affects Joomla CMS 4.0.0-5.4.7 and 6.0.0-6.1.2. Fixed in Joomla 5.4.8 and 6.1.3; reported on 2026-07-09 by Agamemnon Fakas and caveeroo.
28
[20260801] - Core - Response header injection in download views
Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.
Joomla disclosed a response header injection flaw (CVE-2026-71572) in multiple download views, caused by lack of output processing, enabling reflected file download and content-type confusion. It is rated low impact, severity, and probability and affects Joomla CMS 3.0.0-5.4.7 and 6.0.0-6.1.2. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.
18
57
60
42
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.
52
Metasploit Wrap Up: Lot of summer shells and fit http profiles
Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.
Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.
32
Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
60
60
42