← All frameworks
34
Joomla
legacy
php · cms · since 2005
migrate away
↓
3.0 pts
vs last month
Updated June 2026
Joomla scores 34/100. Consider migrating to: nextjs, astro, hugo.
Dimension breakdown
Security
800 total CVEs on record. 65 critical severity. 5 actively exploited (CISA KEV).
Total Cves
800
Critical Cves
65
Exploited Cves
5
Avg Cvss
6.8
Cves Last Year
80
Performance
Average performance. Room for optimization.
Ecosystem
4,800 GitHub stars. 100 contributors. 4 releases in the last year.
Stars
4,800
Contributors
100
Releases Last Year
4
Avg Issue Close Days
90
Ai Readiness
Very poor AI-readiness. Closed ecosystem or heavy client-side rendering. Not designed for machine consumption. Consider migration for AI-first use cases.
Structured Output
25
Api First
0.0
Headless Capable
0.0
Developer Experience
Below-average developer experience. Legacy patterns, complex configuration.
Market Trajectory
Score
20
Market Share Pct
1.2
Cost Of Ownership
High cost. Significant hosting, maintenance, and security patching burden.
Actively exploited vulnerabilities
Updated 2026-07-13
3 entries
3 confirmed vulnerabilities being actively exploited in real attacks right now. Source: CISA Known Exploited Vulnerabilities.
80% probability of exploitation within 30 days
EPSS score · FIRST.org
Latest entry: 2026-07-07
Joomla scores 34/100 overall. Strongest dimension: performance (65). Weakest: market trajectory (20).
Latest Joomla insights
Joomla Page Builder Flaw Lands on CISA's Actively Exploited Vulnerability List
July 8, 2026 · 5 min
The AI Readiness Gap: 70 Points Separate the Best From the Worst
June 24, 2026 · 6 min
WordPress Ships Zero GitHub Releases. Every Other Framework Ships 40–50.
June 23, 2026 · 5 min
Joomla Ships 644 Commits Per Year. It Still Carries 1,313 CVEs.
June 23, 2026 · 5 min
Joomla: 1,313 CVEs and 352K Sites That Can't Leave
June 22, 2026 · 5 min