CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 18/08/2026 |
| CVE-2026-73337 | 高危7.5 | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 18/08/2026 |
| CVE-2026-72532 | 中危5.4 | Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints. | 18/08/2026 |
| CVE-2026-71574 | 中危6.5 | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | 18/08/2026 |
| CVE-2026-48958 | 高危8.8 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. | 07/07/2026 |
| CVE-2026-48957 | 高危8.8 | An improper access check allows unauthorized users to access com_privacy datasets. | 07/07/2026 |
| CVE-2026-48956 | 中危5.0 | An improper access check allows users to display a list of modules in the frontend. | 07/07/2026 |
| CVE-2026-48955 | 中危6.5 | An improper access check allows unauthorized users to access workflow stage and transition information. | 07/07/2026 |
| CVE-2026-48954 | 中危6.1 | Improper validation leads to a generic XSS vector in the language override feature. | 07/07/2026 |
| CVE-2026-48953 | 中危6.1 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | 07/07/2026 |
| CVE-2026-48952 | 中危6.1 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | 07/07/2026 |
| CVE-2026-48951 | 中危6.1 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | 07/07/2026 |
| CVE-2026-48950 | 中危6.1 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | 07/07/2026 |
| CVE-2026-48949 | 中危6.1 | Lack of validation leads to an XSS vulnerability in the MFA management views. | 07/07/2026 |
| CVE-2026-48948 | 高危8.8 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | 07/07/2026 |
| CVE-2026-48947 | 中危4.9 | An improper access check allows privileged users to overwrite media files without editing permissions. | 07/07/2026 |
| CVE-2017-20267 | 高危8.2 | Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database informati | 19/06/2026 |
| CVE-2026-48905 | 中危6.1 | Lack of input filtering leads to an XSS vector in the HTML filter code. | 26/05/2026 |