| CVE-2026-71572 | MÉDIO5.4 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion. | 18/08/2026 |
| CVE-2026-73373 | CRÍTICO9.8 | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution. | 18/08/2026 |
| CVE-2026-73371 | MÉDIO4.3 | Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. | 18/08/2026 |
| CVE-2026-73337 | ALTO7.5 | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 18/08/2026 |
| CVE-2026-72532 | MÉDIO5.4 | Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints. | 18/08/2026 |
| CVE-2026-71574 | MÉDIO6.5 | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | 18/08/2026 |
| CVE-2026-48958 | ALTO8.8 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. | 07/07/2026 |
| CVE-2026-48957 | ALTO8.8 | An improper access check allows unauthorized users to access com_privacy datasets. | 07/07/2026 |
| CVE-2026-48956 | MÉDIO5.0 | An improper access check allows users to display a list of modules in the frontend. | 07/07/2026 |
| CVE-2026-48955 | MÉDIO6.5 | An improper access check allows unauthorized users to access workflow stage and transition information. | 07/07/2026 |
| CVE-2026-48954 | MÉDIO6.1 | Improper validation leads to a generic XSS vector in the language override feature. | 07/07/2026 |
| CVE-2026-48953 | MÉDIO6.1 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | 07/07/2026 |
| CVE-2026-48952 | MÉDIO6.1 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | 07/07/2026 |
| CVE-2026-48951 | MÉDIO6.1 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | 07/07/2026 |
| CVE-2026-48950 | MÉDIO6.1 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | 07/07/2026 |
| CVE-2026-48949 | MÉDIO6.1 | Lack of validation leads to an XSS vulnerability in the MFA management views. | 07/07/2026 |
| CVE-2026-48948 | ALTO8.8 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | 07/07/2026 |
| CVE-2026-48947 | MÉDIO4.9 | An improper access check allows privileged users to overwrite media files without editing permissions. | 07/07/2026 |
| CVE-2026-48905 | MÉDIO6.1 | Lack of input filtering leads to an XSS vector in the HTML filter code. | 26/05/2026 |
| CVE-2026-48904 | CRÍTICO9.8 | An improper access check allows privelege escalation through the com_users group editing webservice endpoint. | 26/05/2026 |