19126 matches found
CVE-2026-35220 Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of comusers...
CVE-2026-35220
This CVE (CVE-2026-35220) concerns Joomla! core (com_users) with an admin activation endpoint lacking CSRF token validation. The underlying issue enables a CSRF attack vector against the activation flow, as indicated by the description from multiple sources. The CVSS assessment (4.6, MEDIUM) refl...
CVE-2026-40383 Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability...
CVE-2026-40383
CVE-2026-40383 is a Joomla! Core vulnerability described as an LFI due to improper validation of user-supplied input in the HTMLView layout parameter. NVD lists a high/critical exposed impact with a network attack vector and no user interaction required; separate CVSS 4.0 vector also indicates hi...
CVE-2026-40383 Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability...
CVE-2026-35222 Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in comtags...
CVE-2026-35222 Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in comtags...
CVE-2026-35222
CVE-2026-35222 affects Joomla! Core — com_tags component. The root cause is improperly validated order clauses, leading to authenticated blind SQL injection. Impact is high on confidentiality and integrity; exploitation requires authenticated access with high privileges. No remediation details ar...
CVE-2026-40384
CVE-2026-40384 affects Joomla! Core — com_media webservice endpoint. The issue is improper validation of the search parameter in the com_media files API, enabling path traversal. Documented across NVD, CVE records, and security feeds; impact described as path traversal with high confidentiality i...
CVE-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
CVE-2026-40384 Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...
CVE-2026-48905
The CVE-2026-48905 entry describes a vulnerability in the Joomla! Framework related to the cleanAttributes filter code, where inadequate input filtering creates an XSS vector in the HTML filtering path. According to the available metrics, this is a CVSS 4.0 base score of 6.9 (Medium) with impact ...
CVE-2026-48905 Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code...
CVE-2026-48905 Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code...
CVE-2026-48897
CVE-2026-48897 relates to the Joomla! Core MFA authentication bypass. The issue is caused by insufficient state checks and, per the linked Joomla security advisory and NVD record, a vector that bypasses 2FA. Consequences stated include high impact on integrity with no confidentiality/availability...
CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-48897 Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-25901 Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component...
CVE-2026-25901
CVE-2026-25901 affects Joomla! Core — specifically the multilingual associations component. The root cause is a lack of output escaping in com_associations, which creates a reflected/XSS vector when user-supplied content is rendered. Documented impact indicates potential for script execution that...