48
CVEs
1
Critical
12
High
0
KEV
1
PoC
13
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
12
MEDIUM
35
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48902 | Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. Affected installations span Joomla! 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0, exposing reset tokens to network interception. No public exploit identified at time of analysis, and EPSS scores exploitation probability at 0.02% (5th percentile) despite the 9.8 CVSS rating. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-73373 | Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre. | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-23898 | Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote attackers to delete files on affected servers due to insufficient input validation. The vulnerability affects all versions of Joomla! CMS through the update component and carries moderate-to-high real-world risk because file deletion can compromise system integrity, availability, and potentially enable privilege escalation or secondary attacks when combined with other weaknesses. | HIGH | 8.6 | 0.1% | 43 |
No patch
|
| CVE-2026-35223 | Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges to access configuration data they should not be permitted to reach, impacting confidentiality, integrity, and availability of the affected site. The flaw spans Joomla 4.0.0-5.4.5 and 6.0.0-6.1.0 and was disclosed by the Joomla! Project itself with a CVSS 4.0 base of 8.6. No public exploit identified at time of analysis and EPSS is very low at 0.04%. | HIGH | 8.6 | 0.0% | 43 |
No patch
|
| CVE-2026-23899 | Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and access protected API functionality without valid credentials. Joomla! CMS versions prior to the patched release are affected. The vulnerability stems from inadequate validation of user permissions before processing webservice requests, enabling remote unauthenticated attackers to interact with restricted endpoints that should require administrative or elevated privileges. | HIGH | 8.6 | 0.0% | 43 |
PoC
No patch
|
| CVE-2026-71574 | Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-73337 | Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-48897 | Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor authentication (MFA) due to insufficient state validation during the login flow. The flaw, tracked as CVE-2026-48897 and reported by the Joomla! project, undermines the integrity protections expected from 2FA and could grant attackers access to accounts whose credentials are already known or guessable. EPSS probability is low (0.04%, 13th percentile) and there is no public exploit identified at time of analysis. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-48896 | Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent MFA checks due to insufficient state validation during the authentication flow. The flaw (CWE-287) was disclosed by the Joomla! project itself and tracked as EUVD-2026-31890; no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), but the integrity impact is high since attackers reaching this path effectively defeat the second authentication factor. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-48898 | Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users batch task due to an improper access check (CWE-284). The flaw enables unauthorized modification of user accounts and elevation of privileges across affected installations, with no public exploit identified at time of analysis. EPSS scoring is 0.00% and the vulnerability is not listed in CISA KEV, but the CVSSv4 base score of 8.2 reflects high integrity impact. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-48904 | Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abuse an improper access check in the com_users group editing webservice endpoint to elevate privileges. The CVSS 4.0 vector indicates network-reachable exploitation without authentication or user interaction, with high impact to integrity but no confidentiality or availability impact. There is no public exploit identified at time of analysis and EPSS is effectively 0%, but the vendor advisory confirms the access-control flaw. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-48901 | Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without including a security-sensitive parameter, allowing a previously cached filter instance to be returned even when a different security posture was requested. Remote unauthenticated attackers can leverage the resulting filter mismatch to retrieve sensitive data (CVSS 7.5, C:H only). No public exploit identified at time of analysis and EPSS is 0.02% (5th percentile), indicating low predicted exploitation in the near term. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2026-40383 | Local file inclusion in Joomla! CMS versions 3.2.1 through 5.4.5 and 6.0.0 through 6.1.0 allows authenticated high-privilege attackers to read arbitrary server files via improper validation of the layout parameter in htmlview. The flaw is reported by the Joomla project itself (EUVD-2026-31888) and no public exploit identified at time of analysis, with EPSS scoring 0.00% and CISA SSVC marking exploitation status as none despite total technical impact. | HIGH | 7.5 | 0.0% | 38 |
No patch
|
| CVE-2026-71573 | Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-25900 | Stored cross-site scripting in Joomla! CMS feed modules allows a high-privileged authenticated attacker to inject unsanitized content that executes in the browser context of a victim user who passively views the affected feed output. Affecting the broad version spans of 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0, the root cause is a failure to apply output escaping before rendering feed module data. No public exploit has been identified at time of analysis, and SSVC confirms no current active exploitation. | MEDIUM | 6.9 | 0.0% | 35 |
No patch
|