Live VEL cross-check

The VEL Cross-Check card (Pro, Settings > Analysis) matches every installed extension against Joomla's official Vulnerable Extensions List — the volunteer-maintained list behind vel.joomla.org — so a publicly disclosed flaw in anything you run shows up next to the built-in update audit instead of staying invisible.

How to read it

Each row is one installed extension with a VEL listing. A VULNERABLE badge means your installed version is at or below the reported affected version; Verify means the listing exists but the version comparison was inconclusive (newer than reported, or an unparseable range like "1.5 and Below") — check the linked VEL entry by hand. The feed line states how many Live listings were parsed and when, so you always know how fresh the signal is.

Fail-open by design

The feed is cached for 24 hours. If a refresh fails you see a STALE badge over the last good data, never an empty card pretending everything is clean — and no match is never presented as proof an extension is safe. Fixing is always through Joomla's own updater; the card links straight there.

Joomla 3

Coming to the Joomla 3 edition with v3.0.0.