Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 669

Export CSV
CVE-2026-71573

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-72531

Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-73336

Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-73372

Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-73371

Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-73337

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48954

Joomla! Core - [20260708] - XSS through language overrides

Improper validation leads to a generic XSS vector in the language override feature.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48949

Joomla! Core - [20260703] - XSS in MFA method management

Lack of validation leads to an XSS vulnerability in the MFA management views.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48948

Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48953

Joomla! Core - [20260707] - XSS in the generic image output layout

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48951

Joomla! Core - [20260705] - XSS in various modalreturn layouts

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48957

Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints

An improper access check allows unauthorized users to access com_privacy datasets.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48956

Joomla! Core - [20260710] - Incorrect Access Control in com_modules

An improper access check allows users to display a list of modules in the frontend.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48955

Joomla! Core - [20260709] - Incorrect Access Control in com_workflow

An improper access check allows unauthorized users to access workflow stage and transition information.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48950

Joomla! Core - [20260704] - XSS in com_templates

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48958

Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48947

Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints

An improper access check allows privileged users to overwrite media files without editing permissions.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-48952

Joomla! Core - [20260706] - XSS in com_installer

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-35222

Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-30894

Joomla! Core - [20260503] - XSS in com_contenthistory

Lack of output escaping leads to a XSS vector in the content history component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!