JEM Joomla extension flaws await stable fix
Multiple security issues in JEM, the Joomla Event Manager component, affect versions below 5.0.1, including stable 5.0.0. The most serious allows anonymous…
Security
Security releases, vulnerabilities and hardening for Joomla.
YOOtheme ZOO flaws fixed in version 4.1.64
YOOtheme has fixed three unauthenticated vulnerabilities in its ZOO Joomla extension, including a critical file-upload flaw that can lead to remote code…
Critical SQL injection fixed in Joomla iCagenda module
A critical, unauthenticated SQL injection affects the iCagenda Calendar module for Joomla, with administrators urged to update to version 4.0.12.
Sourcerer 14.0.0 fixes critical Joomla code execution flaw
Regular Labs has released Sourcerer 14.0.0 to address a critical Joomla vulnerability that could execute PHP from unverified or reflected content.
Outdated PHP patches leave supported branches exposed
mySites.guru says PHP 8.5.7 is behind on security patches even though it is newer than fully patched PHP 8.4.24.
Phoca Cart patches critical unauthenticated SQL injection
Phoca Cart users should review their installed version after a published analysis identified a critical SQL injection in the Joomla extension’s public product…
JoomShaper fixes critical SP Page Builder flaw
JoomShaper has fixed two unauthenticated vulnerabilities in SP Page Builder for Joomla, including a critical flaw that could enable remote code execution…
Cotton Cloud fixes two Joomla access control flaws
Two medium-severity access control vulnerabilities in the Cotton Cloud file-storage extension for Joomla have been fixed in version 2.0.3, according to…
Fabrik fixes critical unauthenticated RCE
Fabrik for Joomla up to version 4.6.6 contains an unauthenticated remote code execution flaw in its calc element. Tracked as CVE-2026-66915, the issue has a…
Critical Gridbox flaws fixed in Joomla extension update
Balbooa’s Joomla page builder Gridbox contains 23 critical vulnerabilities, including pre-authentication remote code execution. mySites.guru says some flaws…
JCE 2.9.99.10 fixes privileged file rename flaw
JCE 2.9.99.10 fixes a file-handling vulnerability that could let a privileged, authenticated user hide a file in the directory they were viewing.
SP Page Builder 6.7.1 fixes four Joomla vulnerabilities
JoomShaper has released SP Page Builder 6.7.1 to fix four vulnerabilities affecting version 6.7.0 and earlier, including a pre-authentication SQL injection and…