Threat database

CVE-2026-73373 is a critical vulnerability in Joomla! CMS affecting versions 1.0.0 through 5.4.6, 6.0.0 through 6.1.2, 1.0.0 through 3.3.0, and 4.0.0 through 4.2.0. It involves unrestricted upload of SHTML files, which were not included in the default dangerous file list. On servers configured to execute SHTML files, this could lead to remote code execution.

CVE-2026-73371 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users with high privileges to perform batch copy operations on items they should not be able to edit. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1.

CVE-2026-73337 is a high-severity vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves an improper authentication flaw where insufficient state checks allow bypassing multi-factor authentication (MFA) protections. This vulnerability enables attackers to circumvent 2FA mechanisms, potentially gaining unauthorized access without completing the required authentication steps.

CVE-2026-72532 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to create categories via webservice endpoints due to insufficient access control checks.

CVE-2026-71574 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to perform mutation actions via webservice endpoints that should be restricted, due to inconsistent ACL checks compared to the backend UI.

CVE-2026-73336 is a medium severity cross-site scripting (XSS) vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The issue arises from improper escaping in schema.org markup outputs, allowing potential injection of malicious scripts during web page generation. This vulnerability does not require user interaction and has low complexity for exploitation but requires high privileges to exploit. No known exploits are reported in the wild. No official patch information is provided in the input data.

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

An improper access check allows privileged users to overwrite media files without editing permissions.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

An improper access check allows unauthorized users to access workflow stage and transition information.

An improper access check allows users to display a list of modules in the frontend.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Lack of validation leads to an XSS vulnerability in the MFA management views.

Improper validation leads to a generic XSS vector in the language override feature.

CVE-2026-48904 is a high-severity vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.

CVE-2026-48899 is a medium severity vulnerability in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.