Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates
6,933 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.
Joomla! Core - [20260511] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:55.573Z. Updated 2026-05-27T09:15:12.329Z.
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:19.690Z. Updated 2026-05-27T09:14:34.686Z.
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:14.402Z. Updated 2026-05-27T09:14:28.517Z.
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:13.390Z. Updated 2026-06-05T07:30:10.304Z.
haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection
A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/bash.rs of the component Blacklist Handler. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been p…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:10.781Z. Updated 2026-05-28T14:00:38.706Z.
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:02.051Z. Updated 2026-05-27T09:14:15.239Z.
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:45:00.666Z. Updated 2026-05-27T09:14:13.346Z.
Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:44:53.779Z. Updated 2026-05-27T09:14:05.696Z.
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:44:25.314Z. Updated 2026-05-27T09:28:14.477Z.
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header.…
Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:44:09.104Z. Updated 2026-05-26T17:27:56.507Z.
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
An improper access check allows privilege escalation through the com_users batch task.
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:44:06.616Z. Updated 2026-05-27T09:13:16.497Z.
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:51.153Z. Updated 2026-05-27T09:12:59.814Z.
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:32.835Z. Updated 2026-06-05T07:28:36.374Z.
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:21.784Z. Updated 2026-05-27T09:12:29.087Z.
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:13.780Z. Updated 2026-05-27T09:12:20.038Z.
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:08.503Z. Updated 2026-05-27T09:12:13.794Z.
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:43:03.205Z. Updated 2026-05-27T09:12:08.924Z.
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
An improper access check allows privilege escalation through the com_users batch task.
Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:42:59.328Z. Updated 2026-05-27T09:12:03.902Z.
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:42:58.268Z. Updated 2026-06-05T07:28:01.850Z.
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-26T16:42:41.476Z. Updated 2026-06-05T07:27:45.423Z.