CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2026-48900 | MEDIUM4.3 | An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. | 26/05/2026 |
| CVE-2026-48899 | CRITICAL9.8 | An improper access check allows privilege escalation through the com_users batch task. | 26/05/2026 |
| CVE-2026-48898 | CRITICAL9.8 | An improper access check allows privilege escalation through the com_users batch task. | 26/05/2026 |
| CVE-2026-48897 | HIGH7.5 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 26/05/2026 |
| CVE-2026-48896 | HIGH7.5 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 26/05/2026 |
| CVE-2026-40384 | HIGH7.5 | An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. | 26/05/2026 |
| CVE-2026-40383 | CRITICAL9.8 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. | 26/05/2026 |
| CVE-2026-35223 | CRITICAL9.8 | An improper access check allows unauthorized access to com_config webservice endpoints. | 26/05/2026 |
| CVE-2026-35222 | CRITICAL9.8 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. | 26/05/2026 |
| CVE-2026-35221 | CRITICAL9.8 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. | 26/05/2026 |
| CVE-2026-35220 | MEDIUM4.3 | Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. | 26/05/2026 |
| CVE-2026-30895 | MEDIUM6.1 | Lack of output escaping leads to a XSS vector in the readmore links for com_content. | 26/05/2026 |
| CVE-2026-30894 | MEDIUM6.1 | Lack of output escaping leads to a XSS vector in the content history component. | 26/05/2026 |
| CVE-2026-25901 | MEDIUM6.1 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | 26/05/2026 |
| CVE-2026-25900 | MEDIUM6.1 | Lack of output escaping leads to a XSS vector in the feed modules. | 26/05/2026 |
| CVE-2026-23899 | HIGH8.8 | An improper access check allows unauthorized access to webservice endpoints. | 01/04/2026 |