- [20180602] – Core – XSS vulnerability in language switcher module
- [20180601] – Core – Local File Inclusion with PHP 5.3
- [20180509] – Core – XSS vulnerability in the media manager
- [20180508] – Core – Possible XSS attack in the redirect method
- [20180507] – Core – Session deletion race condition
- [20180506] – Core – Filter field in com_fields allows remote code execution
- [20180505] – Core – XSS Vulnerabilities & additional hardening
- [20180504] – Core – Installer leaks plain text password to local user
- [20180503] – Core – Information Disclosure about unpublished tags
- [20180502] – Core – Add PHAR files to the upload blacklist
