Joomla!: 4.4.14 → 5.4.8
Joomla! · upgrade impact
Upgrade impact: Major upgrade. Crossing a major version usually means breaking changes. Review the vendor’s upgrade / migration guide and test before you roll it out.
Fixed by upgrading to 5.4.8 iVulnerabilities that affect 4.4.14 but no longer affect 5.4.8 — the security gain from this upgrade, by exploited status then exploitation probability.
Exploited first, then by exploitation probability (EPSS).
CVE-2026-35223 CRITICAL EPSS 13% ✓ cleared in 5.4.8 CVE-2026-40383 CRITICAL EPSS 13% ✓ cleared in 5.4.8 CVE-2026-48904 CRITICAL EPSS 5% ✓ cleared in 5.4.8 CVE-2026-73373 CRITICAL EPSS 1% ✓ cleared in 5.4.8 CVE-2026-40384 HIGH EPSS 1% ✓ cleared in 5.4.8 CVE-2026-73337 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-23898 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48958 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48948 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48957 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-23899 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48896 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21630 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-90915 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-71574 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-71573 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48947 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-35221 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-35222 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48956 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48898 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92231 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92227 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92224 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92225 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-72532 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-72531 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-21629 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48902 CRITICAL EPSS 0% ✓ cleared in 5.4.8 CVE-2026-90907 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48901 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48949 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48950 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48951 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48952 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48953 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-48954 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-71572 MEDIUM EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92222 HIGH EPSS 0% ✓ cleared in 5.4.8 CVE-2026-92232 MEDIUM EPSS 0% ✓ cleared in 5.4.8Still open in 5.4.8 iKnown vulnerabilities that affect 5.4.8 too — upgrading to it does not clear these.
These affect 5.4.8 as well — a later release may be needed.
CVE-2026-73371 MEDIUM EPSS 0% → see advisory