Where
-Infinity
0

Trending

Last week
Last month
Last year

composer/getkirby/cmsKirby: System API endpoint leaks license data and installed version to authenticated users

Risk 26
Severity
5.3
First published (updated )
CVE-2026-42051

composer/getkirby/cmsKirby: User avatar creation, replacement and deletion are not gated by user update permissions

Risk 26
Severity
5.3
First published (updated )
CVE-2026-42174

composer/getkirby/cmsKirby: Read access to site, user and role information is not gated by permissions

Risk 40
Severity
7.1
First published (updated )
CVE-2026-42069

composer/getkirby/cmsKirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Risk 40
Severity
7.1
First published (updated )
CVE-2026-42137

composer/getkirby/cmsKirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

Risk 79
Severity
7.1
First published (updated )
CVE-2026-41325
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

Risk 38
Severity
5.3
First published (updated )
CVE-2026-40099

composer/getkirby/cmsKirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

Risk 60
Severity
7.6
First published (updated )
CVE-2026-34587

composer/getkirby/cmsKirby has XML injection in its XML creator toolkit

Risk 43
Severity
6.9
First published (updated )
CVE-2026-32870

Kirby Kirby CMSInput Validation

Risk 38
Severity
6.5
First published (updated )
CVE-2026-29905

kirby/kirbyKirby is missing permission checks in the content changes API

Risk 30
Severity
5.8
EPSS
0.03%
First published (updated )
CVE-2026-21896
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby cross-site scripting (XSS) in the link field "Custom" type

Risk 25
Severity
5.4
EPSS
0.04%
First published (updated )
CVE-2024-27087

composer/getkirby/cmsAn HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: …

Risk 39
Severity
7.1
EPSS
0.04%
First published (updated )
CVE-2024-26482

composer/getkirby/cmsXSS, Code Injection

Risk 57
Severity
8.8
EPSS
0.04%
First published (updated )
CVE-2024-26483

composer/getkirby/cmsXSS

Risk 24
Severity
4.7
EPSS
0.04%
First published (updated )
CVE-2024-26481

Kirby Kirby CMSXSS

Risk 27
Severity
6.1
EPSS
0.04%
First published (updated )
CVE-2024-26484
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getkirby KirbyUser enumeration in the code-based login and password reset forms

Risk 32
Severity
4.8
First published (updated )
CVE-2022-39314

getkirby KirbyCSRF

Risk 22
Severity
4.3
First published (updated )
CVE-2018-14519

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203