HikaShop 6.8.1 fixes unauthorised file downloads
HikaShop 6.8.1 fixes a high-severity information disclosure flaw that could let unauthenticated visitors download files from the extension’s secure upload…
Security
Security releases, vulnerabilities and hardening for Joomla.
JReviews fixes web-accessible cache secret disclosure
ClickFWD has fixed a high-severity information disclosure flaw in JReviews that could expose Joomla secrets and stored API keys through a web-accessible cache…
Gantry 5 fixes high-severity Joomla file upload flaw
Gantry 5.6.7 addresses a high-severity Joomla file upload vulnerability, while sites running Joomla 3 or 4 remain without a fixed Gantry release.
Akeeba fixes Joomla CSRF flaws tracked as CVE-2026-105296
Akeeba fixed cross-site request forgery vulnerabilities in its Joomla extensions months before CVE-2026-105296 was published, but administrators still running…
Tassos Joomla extensions fix two security flaws
Tassos has released security updates for Advanced Custom Fields and Smile Pack for Joomla, fixing a high-severity stored XSS issue and a medium-severity image…
Gridbox 2.20.5.0 fixes four Joomla security flaws
Balbooa’s Gridbox 2.20.5.0 fixes four security vulnerabilities in the Joomla page-builder extension, including an unauthenticated file-deletion flaw rated High.
Critical Custom Tables upload flaw fixed in version 3.7.8
JoomlaBoat has fixed a critical unauthenticated file-upload vulnerability in its Custom Tables extension for Joomla, affecting versions 1.0 through 3.7.7.
Regular Labs fixes Joomla extension vulnerabilities
Regular Labs has fixed two vulnerabilities in its Joomla extensions, including a high-severity code-execution issue requiring coordinated updates to Articles…
JoomShopping 5.10.0 adds security checks and new APIs
JoomShopping 5.10.0 is available with security fixes for CSRF handling, uploaded and downloaded files, and stored data. The Joomla e-commerce extension also…
Helix Ultimate 2.2.11 fixes multiple Joomla security issues
JoomShaper’s Helix Ultimate 2.2.11 addresses several security issues affecting releases from 2.0.0 through 2.2.10, but administrators must update both the…
iCagenda security update fixes stored XSS and CSV injection
JoomliC has issued security releases for the Joomla extension iCagenda, fixing stored cross-site scripting and CSV formula injection vulnerabilities.
Quix 6.4.0 fixes unauthorised article access
ThemeXpert’s Quix Page Builder 6.4.0 fixes an access-control flaw that allowed unauthenticated visitors to retrieve restricted Joomla article content.