Joomla security vulnerabilities at a glance
Every vulnerability the Joomla project has published as a CNA - core and third-party extensions - merged with the HTProtect definitions feed. For each entry you see whether HTProtect warns about it and whether the firewall already blocks the attack.
This page lists every Joomla security vulnerability that the Joomla! project has published as a CNA - both flaws in the Joomla core and flaws in third-party extensions. The data comes live from the National Vulnerability Database (NVD) and is refreshed automatically; withdrawn identifiers are filtered out.
What you will not find anywhere else: each entry also shows what HTProtect does about it. Two separate markers - a warning means affected sites are told about the vulnerable extension - and where automatic updating is switched on, HTProtect starts it right away; firewall means the attack route is blocked outright, even before the update is installed.
Feed version: –
How to read this list
Each row starts with a colour bar for the severity, followed by the CVE identifier and the CVSS base score. The label behind it says whether the flaw sits in the Joomla core or in an extension. Click a row to open the full description, the vector, the publication date and the original sources.
The severity comes from the CVSS score assigned in the NVD: 9.0 and above counts as critical, 7.0 to 8.9 as high, 4.0 to 6.9 as medium. A handful of entries carry no score yet because the assessment is still pending - they appear under „unrated“ and are not automatically harmless.
What the two HTProtect markers mean
Warning means the extension is on the HTProtect warning list. Every installation that has it fetches this list automatically and shows the operator a notice in the dashboard, including the version that fixes it.
Firewall means more: HTProtect carries a signature for this specific attack route. The request is rejected before it reaches the vulnerable code - which matters most in the window between a flaw becoming public and the update actually being installed. That window is where most sites are lost.
Where neither marker appears, we say so plainly. It does not mean the entry is harmless; it means we have nothing that covers it, and we would rather admit that than imply protection that is not there.
Joomla security vulnerabilities by RSS
Nobody checks a list every day. The RSS feed delivers new entries to your reader as soon as they are published - no account, no email address, no tracking.
Frequently asked questions
How up to date is this list?
The vulnerability data is fetched from the NVD several times a day and cached briefly; the HTProtect coverage is re-read every few minutes. The timestamp at the foot of the page shows when the data you are looking at was assembled.
Does the list cover the Joomla core or extensions?
Both. The Joomla project acts as a CNA for its own core and also issues identifiers for third-party extensions. You can filter by area with the buttons above the list.
Why do some entries have no CVE identifier?
A few come from the HTProtect definitions feed rather than the NVD - vulnerabilities we cover although no CVE has been issued for them. Exactly the entries a pure NVD mirror cannot show.
Do I need HTProtect to use this page?
No. The list is free and open to everyone, with no account. The two markers simply show what HTProtect would do for a site that has it installed.
What should I do if an extension I use is listed?
Update it to the version named in the entry. If no fix exists, uninstall the extension rather than merely unpublishing it - the code stays reachable otherwise.