Joomla!: 3.10.12 → 5.4.8
Joomla! · upgrade impact
Upgrade impact: Major upgrade (2 major versions). Crossing a major version usually means breaking changes. Review the vendor’s upgrade / migration guide and test before you roll it out.
Fixed by upgrading to 5.4.8 iVulnerabilities that affect 3.10.12 but no longer affect 5.4.8 — the security gain from this upgrade, by exploited status then exploitation probability.
Exploited first, then by exploitation probability (EPSS).
CVE-2024-21726 MEDIUM EPSS 49% ✓ cleared in 5.4.8 CVE-2026-40383 CRITICAL EPSS 13% ✓ cleared in 5.4.8 CVE-2023-40626 HIGH EPSS 1% ✓ cleared in 5.4.8 CVE-2026-73373 CRITICAL EPSS 1% ✓ cleared in 5.4.8 CVE-2024-21723 MEDIUM EPSS 1% ✓ cleared in 5.4.8 CVE-2024-21724 MEDIUM EPSS 1% ✓ cleared in 5.4.8 CVE-2024-21722 MEDIUM EPSS 1% ✓ cleared in 5.4.8 CVE-2024-26279 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-23898 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2024-26278 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2024-21731 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2024-27185 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2024-40748 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48948 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-23899 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2024-40749 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21630 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-35221 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-35222 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2024-40743 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92231 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21629 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2024-27184 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48902 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-90907 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48954 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-71572 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92232 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21631 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-90906 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2025-63083 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21632 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-25900 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-30894 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-25901 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-30895 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48903 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48905 MEDIUM EPSS 0% ✓ cleared in 5.4.8Still open in 5.4.8 iKnown vulnerabilities that affect 5.4.8 too — upgrading to it does not clear these.
These affect 5.4.8 as well — a later release may be needed.
CVE-2026-73371 MEDIUM EPSS 0% → see advisory