Joomla MFA bypass affects 4.x and 6.x releases
Administrators running Joomla! CMS 4.0.0-5.4.5 or 6.0.0-6.1.0 should upgrade to 5.4.6 or 6.1.1 to address a Moderate-severity MFA authentication bypass.
Security
Security releases, vulnerabilities and hardening for Joomla.
Joomla com_media path traversal requires an update
Joomla! CMS installations running 4.0.0-5.4.5 or 6.0.0-6.1.0 should be upgraded to 5.4.6 or 6.1.1 to address a Moderate path traversal vulnerability.
Joomla fixes high-severity LFI in HTMLView layout parameter
Administrators running Joomla! CMS versions 3.2.1-5.4.5,6.0.0-6.1.0 should upgrade to 5.4.6,6.1.1 to address a High-severity Local File Inclusion vulnerability…
Joomla com_config webservice access flaw fixed
Joomla CMS administrators running affected 4.x or 6.x versions should upgrade to the corresponding fixed release for an improper access check in com_config…
Joomla com_tags affected by authenticated blind SQLi
Joomla administrators using versions 4.0.0-5.4.5 or 6.0.0-6.1.0 should upgrade to 5.4.6 or 6.1.1 to address an authenticated blind SQLi in com_tags, tracked as…
Joomla 6.0.0-6.1.0 affected by CSRF activation flaw
Administrators running Joomla! CMS 6.0.0-6.1.0 should upgrade to 6.1.1 to address a Moderate CSRF vulnerability in the user activation endpoint.
Joomla XSS flaw affects 4.x and 6.x installations
Joomla CMS installations running 4.0.0-5.4.5 or 6.0.0-6.1.0 are affected by a Moderate XSS issue in the content history component; administrators should…
Joomla fixes moderate XSS in com_associations
Administrators running affected Joomla! CMS releases should upgrade to a fixed version to address a cross-site scripting issue in the multilingual associations…
Joomla feed modules affected by moderate XSS flaw
Joomla administrators running affected CMS releases should upgrade to 5.4.6 or 6.1.1 to address a moderate XSS vulnerability in feed modules.
Sorry ransomware exploits critical cPanel authentication flaw
Sorry ransomware is targeting cPanel-hosted sites through a critical authentication bypass in cPanel and WHM, encrypting files and adding the .sorry extension.
AcyMailing privilege escalation also affects Joomla sites
A privilege-escalation vulnerability identified as CVE-2026-3614 also affects Joomla installations of AcyMailing, despite public advisories describing the…
Malicious Smart Slider 3 Pro release affected Joomla sites
Nextend’s Smart Slider 3 Pro 3.5.1.35 was a malicious release distributed through the official update channel, giving affected Joomla sites a remote…