AcyMailing 11.1.0 fixes two serious Joomla flaws
AcyMailing 11.1.0 fixes two serious security flaws affecting earlier versions with certain features enabled, including an arbitrary file-write issue and a…
Security
Security releases, vulnerabilities and hardening for Joomla.
EasyStore 3.0.1 fixes seven Joomla security flaws
JoomShaper has released EasyStore 3.0.1 for Joomla, fixing seven security vulnerabilities that affected every version below 3.0.1, including 2.0.1 and 3.0.0.
Gridbox 2.20.3.1 fixes unauthenticated SQL injection
Balbooa has released Gridbox 2.20.3.1 for Joomla to fix a high-severity, unauthenticated blind SQL injection in the extension’s public blog author filter.
OS Gallery 6.2.7 fixes four Joomla vulnerabilities
OrdaSoft's OS Gallery for Joomla contains four vulnerabilities in versions through 6.2.6, including a critical SQL injection that requires no login. Version…
JoomGallery fixes unauthenticated file-upload flaw
JoomGallery 4.0.0 through 4.4.1 contains an unauthenticated file-upload vulnerability that is fixed in version 4.4.2.
J2Store fixes six security flaws across all supported branches
J2Commerce has fixed six security vulnerabilities in J2Store, including an unauthenticated SQL injection that could expose a shop’s database.
SP Page Builder flaws fixed in version 6.9.1
JoomShaper has fixed five security vulnerabilities in the Joomla SP Page Builder extension, including a High-severity SQL injection and a Medium-severity…
mySites.guru reports 19 Joomla extension vulnerabilities
mySites.guru says it found 19 vulnerabilities in 17 Joomla extensions during June and July 2026, including five rated CVSS 10.0.
miniOrange OAuth Client flaw enables Joomla account takeover
A critical flaw in the miniOrange OAuth Client extension for Joomla allows unauthenticated account takeover, including access to administrator accounts.
JEM Joomla extension flaws await stable fix
Multiple security issues in JEM, the Joomla Event Manager component, affect versions below 5.0.1, including stable 5.0.0. The most serious allows anonymous…
Fabrik 4.7.2 fixes 16 Joomla vulnerabilities
Fabrikar has released Fabrik 4.7.2 for Joomla, addressing 16 CVE-listed vulnerabilities that include unauthenticated remote code execution, SQL injection and…
YOOtheme ZOO flaws fixed in version 4.1.64
YOOtheme has fixed three unauthenticated vulnerabilities in its ZOO Joomla extension, including a critical file-upload flaw that can lead to remote code…