CVE-2026-35222

CVE-2026-35222 affects Joomla! Core — com_tags component. The root cause is improperly validated order clauses, leading to authenticated blind SQL injection. Impact is high on confidentiality and integrity; exploitation requires authenticated access with high privileges. No remediation details ar...

CVE-2026-40384

CVE-2026-40384 affects Joomla! Core — com_media webservice endpoint. The issue is improper validation of the search parameter in the com_media files API, enabling path traversal. Documented across NVD, CVE records, and security feeds; impact described as path traversal with high confidentiality i...

CVE-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint

An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...

CVE-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint

An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...

CVE-2026-48905

The CVE-2026-48905 entry describes a vulnerability in the Joomla! Framework related to the cleanAttributes filter code, where inadequate input filtering creates an XSS vector in the HTML filtering path. According to the available metrics, this is a CVSS 4.0 base score of 6.9 (Medium) with impact ...

CVE-2026-48905 Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.

Lack of input filtering leads to an XSS vector in the HTML filter code...

CVE-2026-48905 Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.

Lack of input filtering leads to an XSS vector in the HTML filter code...

CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-48897

CVE-2026-48897 relates to the Joomla! Core MFA authentication bypass. The issue is caused by insufficient state checks and, per the linked Joomla security advisory and NVD record, a vector that bypasses 2FA. Consequences stated include high impact on integrity with no confidentiality/availability...

CVE-2026-25901 Joomla! Core - [20260502] - XSS in com_associations

Lack of output escaping leads to a XSS vector in the multilingual associations component...

CVE-2026-25901

CVE-2026-25901 affects Joomla! Core — specifically the multilingual associations component. The root cause is a lack of output escaping in com_associations, which creates a reflected/XSS vector when user-supplied content is rendered. Documented impact indicates potential for script execution that...

CVE-2026-25901 Joomla! Core - [20260502] - XSS in com_associations

Lack of output escaping leads to a XSS vector in the multilingual associations component...

CVE-2026-48899 Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins

An improper access check allows privilege escalation through the comusers batch task...

CVE-2026-48899

The CVE-2026-48899 entry concerns Joomla! Core and related sample-data plugins where an improper access check allows privilege escalation via the com_users batch task. The affected surface is core components handling sample data and batch tasks; root cause is insufficient authorization checks ena...

CVE-2026-48900

CVE-2026-48900 affects Joomla! Core (com_scheduler). An improper access check allows low-privileged users to edit the task types of existing scheduler tasks, indicating a privilege-escalation in the scheduler component. The CVE details indicate a CVSS v4 score of 6.4 (MEDIUM) with network attack ...

CVE-2026-48900 Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...

CVE-2026-48900 Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...

CVE-2026-48902

CVE-2026-48902 affects Joomla! Core. The password/username reset features generate plain http links for https connections when Force SSL is not explicitly enabled, enabling possible credential exposure via downgraded transport. The issue is documented across multiple feeds (e.g., JOOMLA-1050) and...

CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set...