{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Joomla! Project Joomla! CMS: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/joomla-project--joomla-cms/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/joomla-project--joomla-cms/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90915/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90915/",
   "title": "CVE-2026-90915 disclosed",
   "content_text": "Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.",
   "date_published": "2026-09-29T16:45:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92226/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92226/",
   "title": "CVE-2026-92226 disclosed",
   "content_text": "Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.",
   "date_published": "2026-09-29T16:45:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92231/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92231/",
   "title": "CVE-2026-92231 disclosed",
   "content_text": "Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the \"javascript:\" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.",
   "date_published": "2026-09-29T16:40:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92222/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92222/",
   "title": "CVE-2026-92222 disclosed",
   "content_text": "Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.",
   "date_published": "2026-09-29T16:38:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92227/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92227/",
   "title": "CVE-2026-92227 disclosed",
   "content_text": "Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.",
   "date_published": "2026-09-29T16:36:45Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92232/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92232/",
   "title": "CVE-2026-92232 disclosed",
   "content_text": "Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.",
   "date_published": "2026-09-29T16:36:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-90913/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-90913/",
   "title": "CVE-2026-90913 disclosed",
   "content_text": "Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints.",
   "date_published": "2026-09-29T16:36:15Z"
  }
 ]
}