Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Joomla Number Of NVD 285 CRITICAL 32 HIGH 73 MEDIUM 178 LOW 2
URL https://www.joomla.org/
Explanation Joomla is an open source Content Management System (CMS).

Each major version is supported for at least four years.

Basically, it is recommended to use the latest version.
Tag
  • PHP
  • オープンソース
  • GPL v2
Add Information URL
No Type Name URL
1 https://downloads.joomla.org/
2 https://www.joomla.org/announcements/release-news/
3 https://docs.joomla.org/Joomla!_CMS_versions
4 http://feeds.joomla.org/JoomlaSecurityNews
5 http://www.joomla.jp/
6 https://developer.joomla.org/roadmap.html
7 https://docs.joomla.org/Release_and_support_cycle
8 https://github.com/joomla
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
11 Joomla 5.1 5.1.4 Aug. 27, 2024 April 16, 2024 5 10 19 0
12 Joomla 5.0 5.0.3 July 9, 2024 Oct. 17, 2023 April 16, 2024 5 11 19 0
13 Joomla 4.4 4.4.13 April 8, 2025 Oct. 17, 2023 Oct. 17, 2025 5 11 19 0
14 Joomla 4.3 4.3.4 Aug. 22, 2023 April 18, 2023 Oct. 17, 2023 5 12 20 0
15 Joomla 4.2 4.4.6 July 9, 2024 Aug. 16, 2022 April 18, 2023 5 12 27 0
16 Joomla 4.1 4.1.5 June 21, 2022 Feb. 15, 2022 Aug. 16, 2022 8 12 28 0
17 Joomla 4.0 4.0.6 Jan. 18, 2022 Aug. 17, 2021 Feb. 15, 2022 9 12 27 0
18 Joomla 3.10 3.10.11 Aug. 16, 2022 Aug. 17, 2021 Aug. 17, 2023 6 7 13 0
19 Joomla 3.9 3.9.28 July 6, 2021 Oct. 30, 2018 Aug. 17, 2023 15 26 68 0
20 Joomla 3.8 3.8.13 Oct. 9, 2018 Sept. 19, 2017 Oct. 30, 2018 17 33 76 0
21 Joomla 3.7 3.7.5 Aug. 17, 2017 April 25, 2017 Sept. 19, 2017 19 34 75 1
22 Joomla 3.6 3.6.5 Dec. 13, 2016 July 12, 2016 April 25, 2017 23 35 79 0
23 Joomla 3.5 3.5.1 April 5, 2016 March 21, 2016 July 12, 2016 23 35 77 0
24 Joomla 3.4 3.4.8 Dec. 24, 2015 Feb. 24, 2015 March 21, 2016 23 41 83 0
25 Joomla 3.3 3.3.4 Sept. 23, 2014 April 20, 2014 Feb. 24, 2015 22 42 83 0
26 Joomla 3.2 3.2.1 Dec. 18, 2014 Nov. 6, 2013 Oct. 31, 2014 22 44 85 0
27 Joomla 3.1 3.1.6 Nov. 6, 2013 April 24, 2013 Dec. 31, 2013 18 35 76 0
28 Joomla 3.0 3.0.3 Feb. 4, 2013 Sept. 27, 2012 May 31, 2013 18 35 81 0
29 Joomla 2.5 2.5.28 Dec. 10, 2014 Jan. 24, 2012 Dec. 31, 2014 13 30 58 0
30 Joomla 1.7 1.7.5 Feb. 2, 2012 July 19, 2011 Feb. 29, 2012 10 17 29 0
31 Joomla 1.6 1.6.6 July 26, 2011 Jan. 10, 2011 Aug. 31, 2011 10 14 30 0
32 Joomla 1.5 1.5.26 March 27, 2012 Jan. 22, 2008 Sept. 30, 2012 11 19 35 1
33 Joomla 1.0 1.0.15 Feb. 21, 2008 Sept. 17, 2005 July 22, 2009 5 15 30 0
34 Joomla 13.1 13.1 0 0 0 0
35 Joomla 12.3 12.3 0 0 0 0
36 Joomla 12.1 12.1 0 0 0 0
37 Joomla 11.4 11.4 0 0 0 0
38 Joomla 11.3 11.3 0 0 0 0
39 Joomla 11.2 11.2 0 0 0 0
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
11 8.8
- 		HIGH
Network 		An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. CWE-284
NVD-CWE-noinfo
Improper Access Control 		CVE-2026-48948 cpe:2.3:a:joomla:joomla\!:*:* 3.0.0
6.0.0

5.4.7
6.1.2 		2026-07-9 23:20
2026-07-8 		Show GitHub Exploit DB Packet Storm
12 4.9
- 		MEDIUM
Network 		An improper access check allows privileged users to overwrite media files without editing permissions. CWE-284
Improper Access Control 		CVE-2026-48947 cpe:2.3:a:joomla:joomla\!:*:* 4.1.0
6.0.0

5.4.7
6.1.2 		2026-07-9 23:26
2026-07-8 		Show GitHub Exploit DB Packet Storm
13 9.8
- 		CRITICAL
Network 		The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. NVD-CWE-noinfo
CWE-319
Cleartext Transmission of Sensitive Information 		CVE-2026-48902 cpe:2.3:a:joomla:joomla\!:*:* 3.0.0
6.0.0

5.4.6
6.1.1 		2026-06-2 23:16
2026-05-27 		Show GitHub Exploit DB Packet Storm
14 7.5
- 		HIGH
Network 		Insufficient state checks lead to a vector that allows to bypass 2FA checks. CWE-287
Improper Authentication 		CVE-2026-48897 cpe:2.3:a:joomla:joomla\!:*:* 4.0.0
6.0.0

5.4.6
6.1.1 		2026-05-29 04:40
2026-05-27 		Show GitHub Exploit DB Packet Storm
15 7.5
- 		HIGH
Network 		Insufficient state checks lead to a vector that allows to bypass 2FA checks. CWE-287
NVD-CWE-noinfo
Improper Authentication 		CVE-2026-48896 cpe:2.3:a:joomla:joomla\!:*:* 4.0.0
6.0.0

5.4.6
6.1.1 		2026-05-29 04:46
2026-05-27 		Show GitHub Exploit DB Packet Storm
16 7.5
- 		HIGH
Network 		An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. CWE-22
Path Traversal 		CVE-2026-40384 cpe:2.3:a:joomla:joomla\!:*:* 4.0.0
6.0.0

5.4.6
6.1.1 		2026-05-29 04:07
2026-05-27 		Show GitHub Exploit DB Packet Storm
17 9.8
- 		CRITICAL
Network 		An improper validation of user-supplied input leads to a local file inclusion vulnerability. CWE-22
Path Traversal 		CVE-2026-40383 cpe:2.3:a:joomla:joomla\!:*:* 3.2.1
6.0.0

5.4.6
6.1.1 		2026-05-27 21:24
2026-05-27 		Show GitHub Exploit DB Packet Storm
18 9.8
- 		CRITICAL
Network 		An improper access check allows unauthorized access to com_config webservice endpoints. CWE-284
NVD-CWE-noinfo
Improper Access Control 		CVE-2026-35223 cpe:2.3:a:joomla:joomla\!:*:* 4.0.0
6.0.0

5.4.6
6.1.1 		2026-05-29 04:07
2026-05-27 		Show GitHub Exploit DB Packet Storm
19 9.8
- 		CRITICAL
Network 		Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. CWE-89
SQL Injection 		CVE-2026-35222 cpe:2.3:a:joomla:joomla\!:*:* 3.0.0
6.0.0

5.4.6
6.1.1 		2026-05-27 21:28
2026-05-27 		Show GitHub Exploit DB Packet Storm
20 9.8
- 		CRITICAL
Network 		Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. CWE-89
SQL Injection 		CVE-2026-35221 cpe:2.3:a:joomla:joomla\!:*:* 3.0.0
6.0.0

5.4.6
6.1.1 		2026-05-27 22:05
2026-05-27 		Show GitHub Exploit DB Packet Storm