CVE Tools
Track your stack

Joomla!

425 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Joomla!, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Joomla! CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Joomla! CVEs per month
MonthCVEs
2024-110
2024-120
2025-013
2025-021
2025-031
2025-042
2025-050
2025-061
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-012
2026-020
2026-030
2026-045
2026-0520
2026-060
2026-0712
2026-0810
2026-0916
2026-100

Severity

How the 425 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical4511%
  • High12329%
  • Medium25159%
  • Low61%

Latest CVEs

The 15 most recently published vulnerabilities affecting Joomla!.

  1. CVE-2026-90915Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.5
  2. CVE-2026-92226Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.0
  3. CVE-2026-92224Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.7
  4. CVE-2026-90907Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.35.3
  5. CVE-2026-90914Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.4
  6. CVE-2026-92231Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.36.7
  7. CVE-2026-90918Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.3
  8. CVE-2026-92222Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.38.0
  9. CVE-2026-92223Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.33.8
  10. CVE-2026-90917Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.3
  11. CVE-2026-92225Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.7
  12. CVE-2026-92227Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.5
  13. CVE-2026-92232Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.36.5
  14. CVE-2026-90916Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.32.7
  15. CVE-2026-90913Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.5

Product grouping is registry-driven, with AI assist and human review. How it works