Joomla workflow access flaw fixed in version 6.1.2
Administrators running Joomla! CMS 6.0.0-6.1.1 should upgrade to 6.1.2 to address a Moderate Incorrect Access Control vulnerability in com_workflow, tracked as…
Security
Security releases, vulnerabilities and hardening for Joomla.
Joomla language overrides expose sites to moderate XSS
Joomla! CMS sites running versions 3.0.0-5.4.5 or 6.0.0-6.1.1 are affected by a Moderate XSS vulnerability in language overrides; administrators should upgrade…
Joomla generic image layout exposed to XSS
Administrators running Joomla! CMS 4.0.0-5.4.5 or 6.0.0-6.1.1 should upgrade to 5.4.7 or 6.1.2 to address a Moderate-severity XSS vulnerability in the generic…
Joomla com_installer XSS fixed in 5.4.7 and 6.1.2
Joomla administrators running affected CMS releases should upgrade to 5.4.7 or 6.1.2, which fix a Moderate XSS vulnerability in com_installer.
Joomla fixes XSS in modalreturn layouts
Joomla administrators should upgrade to version 5.4.7 or 6.1.2 to address a Moderate XSS vulnerability in modalreturn layouts, tracked as CVE-2026-48951.
Joomla fixes XSS in com_templates file management view
Joomla installations in the affected 4.x, 5.x and 6.x ranges should be upgraded to 5.4.7 or 6.1.2 to address a Moderate XSS vulnerability in com_templates…
Joomla MFA XSS fixed in 5.4.7 and 6.1.2
Joomla! CMS versions 4.2.0-5.4.5 and 6.0.0-6.1.1 are affected by an XSS vulnerability in the MFA management views. The Joomla project rates it Moderate…
Joomla fixes access control flaw in contact vCard downloads
Administrators running Joomla! CMS versions 3.0.0-5.4.5 or 6.0.0-6.1.1 should upgrade to 5.4.7 or 6.1.2 to address a Low-severity Incorrect Access Control…
Joomla com_media access flaw fixed in 5.4.7 and 6.1.2
Joomla! CMS installations running 4.1.0-5.4.6 or 6.0.0-6.1.1 are affected by incorrect access control in com_media webservice endpoints; administrators should…
JoomShaper patches serious Helix Ultimate security flaws
JoomShaper has released Helix Ultimate 2.2.7 to fix multiple Joomla security issues, including an unauthenticated menu write that could lead to stored XSS.
Helix3 3.1.1 fixes critical Joomla security flaws
JoomShaper has released Helix3 3.1.1 to address critical security vulnerabilities that could let unauthenticated attackers write and delete files on Joomla…
Hidden cron jobs can restore malware after Joomla cleanup
A mySites.guru investigation warns that Joomla sites can be reinfected by malicious cron jobs hidden outside the account-level schedules visible in hosting…