CVE-2020-13760

In Joomla! before 3.9.19, missing token checks in compostinstall lead to CSRF...

[20200602] - Core - Inconsistent default textfilter settings

The default settings of the global "textfilter" configuration doesn't block HTML inputs for 'Guest' users. With 3.9.19, the textfilter for new installations has been set to 'No HTML' for the groups 'Public', 'Guest' and 'Registered'...