Critical SQL injection fixed in JoomlaBoat YouTube Gallery
JoomlaBoat’s YouTube Gallery extension for Joomla contains a critical unauthenticated SQL injection, affecting versions through 5.7.2 and fixed in 5.7.3.
Security
Security releases, vulnerabilities and hardening for Joomla.
Joomla InputFilter XSS bypass fixed in 5.4.9 and 6.1.4
Joomla administrators running 1.5.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to fix a Moderate XSS issue in InputFilter.
Joomla MFA bypass fixed in 5.4.9 and 6.1.4
Administrators running Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to fix a Moderate-severity MFA authentication bypass involving…
Joomla fixes ACL flaw in web service edit tasks
Administrators running Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to fix CVE-2026-92226.
Joomla module list XSS fixed in CMS updates
Joomla administrators running 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to fix a Moderate XSS vulnerability in the Joomla! CMS module list.
Joomla workflow access checks fixed in security update
Administrators running Joomla! CMS 5.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to fix an incorrect access control vulnerability affecting…
Joomla SSRF flaw affects core extensions
Administrators running affected Joomla! CMS installations should upgrade to 5.4.9 or 6.1.4 to address high-severity SSRF vectors in various core extensions.
Joomla fixes XSS flaw in HTML mail templates
Administrators running Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4 to address a Moderate XSS vulnerability in HTML mail templates…
Joomla XSS affects the link toolbar layout
Administrators using Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 are affected by an XSS issue in the link toolbar layout; upgrade to 5.4.9 or 6.1.4.
Joomla tagged-item ACL flaw exposes restricted content
Administrators running Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4. The issue is an Incorrect Access Control vulnerability with CVE…
Joomla fixes ACL checks in content history comparison
Administrators running affected Joomla CMS releases should upgrade to the available maintenance versions to prevent unauthorized viewing of restricted content.
Joomla cache purge flaw could delete arbitrary directories
Administrators running Joomla! CMS 4.0.0-5.4.8 or 6.0.0-6.1.3 should upgrade to 5.4.9 or 6.1.4, respectively. The High-severity issue, tracked as…