CVE Vulnerability Catalog

Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter due to an HTML5 entity decode mismatch. The checkAttribute method normalizes an attribute value before testing it against the "javascript:" scheme regex, but without decoding HTML5 entities beforehand, causing an XSS vector.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for various webservice edit tasks. An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.

Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

Joomla! Core has improper ACL checks for workflow stage changes. Unauthorized users can update the workflow stage of inaccessible contents. Affects versions 5.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have SSRF vectors in various core extensions. URLs used for serverside requests were improperly validated, leading to SSRF vectors.

Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core has improper ACL checks in the content history comparison view. Unauthorized users can view inaccessible contents. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an arbitrary directory deletion vulnerability via the cache purge action. An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions.

Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for access level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.

SQL Injection vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Electron is a framework for building desktop apps. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled. This allowed untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted.

Electron prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 had an issue where responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604.

Electron prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 did not inherit active HTML sandbox restrictions for windows opened from a sandboxed top-level document. Untrusted content in such a document that was allowed to open popups could create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox.