CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2026-48900 | 中危4.3 | An improper access check allowed low privileged users to edit the task types of existing scheduler tasks. | 26/05/2026 |
| CVE-2026-48899 | 严重9.8 | An improper access check allows privilege escalation through the com_users batch task. | 26/05/2026 |
| CVE-2026-48898 | 严重9.8 | An improper access check allows privilege escalation through the com_users batch task. | 26/05/2026 |
| CVE-2026-48897 | 高危7.5 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 26/05/2026 |
| CVE-2026-48896 | 高危7.5 | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | 26/05/2026 |
| CVE-2026-40384 | 高危7.5 | An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. | 26/05/2026 |
| CVE-2026-40383 | 严重9.8 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. | 26/05/2026 |
| CVE-2026-35223 | 严重9.8 | An improper access check allows unauthorized access to com_config webservice endpoints. | 26/05/2026 |
| CVE-2026-35222 | 严重9.8 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. | 26/05/2026 |
| CVE-2026-35221 | 严重9.8 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. | 26/05/2026 |
| CVE-2026-35220 | 中危4.3 | Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users. | 26/05/2026 |
| CVE-2026-30895 | 中危6.1 | Lack of output escaping leads to a XSS vector in the readmore links for com_content. | 26/05/2026 |
| CVE-2026-30894 | 中危6.1 | Lack of output escaping leads to a XSS vector in the content history component. | 26/05/2026 |
| CVE-2026-25901 | 中危6.1 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | 26/05/2026 |
| CVE-2026-25900 | 中危6.1 | Lack of output escaping leads to a XSS vector in the feed modules. | 26/05/2026 |
| CVE-2026-23899 | 高危8.8 | An improper access check allows unauthorized access to webservice endpoints. | 01/04/2026 |