Vendor
Joomla! vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 28 vulnerabilities in Joomla!: 0 in the last 7 days and 17 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-39790, was published on 6 October 2026. Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 2 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 17
- Critical, all time
- 2
- Exploited in the wild
- 1
About Joomla!
A community-driven organization responsible for the development of the Joomla content management system.
Joomla! technologies
Latest Joomla! vulnerabilities
- CVE-2026-39790: VikRentCar unauthenticated cross-site scripting (XSS)highCVSS 7.1
- CVE-2026-92232: Joomla Core XSS filter bypass in InputFilter with whitespace data URIsinfo
- CVE-2026-92231: Joomla Core XSS filter bypass in InputFilter via HTML5 entity decodeinfo
- CVE-2026-92227: Joomla Core authentication bypass through premature rememberme cookiesinfo
- CVE-2026-92226: Joomla Core improper ACL checks in webservice edit tasksinfo
- CVE-2026-92225: Joomla Core XSS in module listinfo
- CVE-2026-92223: Joomla Core improper ACL checks for workflow stage changesinfo
- CVE-2026-92222: Joomla CMS server-side request forgery in core extensionsinfo
- CVE-2026-90918: Joomla Core stored XSS in HTML mail templatesinfo
- CVE-2026-90917: Joomla Core improper ACL checks in tagged itemsinfo
- CVE-2026-90916: Joomla CMS improper ACL checks in content history comparisoninfo
- CVE-2026-90915: Joomla Core arbitrary directory deletion via cache purgeinfo
- CVE-2026-90914: Joomla Core XSS in generic media output layoutsinfo
- CVE-2026-90913: Joomla Core improper ACL checks in webservice endpointsinfo
- CVE-2026-90907: Joomla CMS authorization bypass in profile.save controllerinfo
- CVE-2026-90906: Joomla Core cross-site scripting in HTMLHelper::link methodinfo
- CVE-2026-85190: Regular Labs Quick Index stored XSS via unescaped class attributeinfoEPSS 0.4%
- CVE-2026-65757: Regular Labs Modules Anywhere improper access control in editor popupinfo
- CVE-2026-64872: Regular Labs Cache Cleaner Pro path traversal in custom purge and log pathsinfo
- CVE-2018-25337: Joomla JoomOCShop CSRF in account management endpointsmediumCVSS 4.3
- CVE-2026-23899: An improper access check allows unauthorized access to webservice endpoints.highCVSS 8.8EPSS 0.4%
- CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.highCVSS 7.2EPSS 0.4%
- CVE-2026-21632: Lack of output escaping for article titles leads to XSS vectors in various locations.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21630: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.highCVSS 8.8EPSS 0.3%
Most severe Joomla! vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-23752: Joomla! Improper Access Control Vulnerabilitycriticalexploited in the wildCVSS 5.3
- CVE-2016-9081: Joomla! CMS account modification and password reset vulnerabilitycriticalCVSS 9.8
- CVE-2026-23899: An improper access check allows unauthorized access to webservice endpoints.highCVSS 8.8EPSS 0.4%
- CVE-2026-21630: Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.highCVSS 8.8EPSS 0.3%
- CVE-2026-21629: The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was…highCVSS 7.3EPSS 0.3%
- CVE-2026-23898: Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.highCVSS 7.2EPSS 0.4%
- CVE-2026-39790: VikRentCar unauthenticated cross-site scripting (XSS)highCVSS 7.1
- CVE-2026-21631: Lack of output escaping leads to a XSS vector in the multilingual associations component.mediumCVSS 5.4EPSS 0.2%
- CVE-2026-21632: Lack of output escaping for article titles leads to XSS vectors in various locations.mediumCVSS 5.4EPSS 0.2%
- CVE-2018-25337: Joomla JoomOCShop CSRF in account management endpointsmediumCVSS 4.3
Vulnerabilities per week
Nothing in the last four weeks, down from 17 vulnerabilities in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 15 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Joomla! vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/joomla)<a href="https://junglewise.ai/threats/vendors/joomla"><img src="https://junglewise.ai/threats/vendors/joomla/badge.svg" alt="Joomla! vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/joomla.json, and this page as text at https://junglewise.ai/threats/vendors/joomla.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Joomla! vulnerabilities", https://junglewise.ai/threats/vendors/joomla, 9 November 2026.