Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how getkirby compares to other vendors in security performance

View Risk Score →

composer/getkirby/cmsKirby: System API endpoint leaks license data and installed version to authenticated users

Risk 26
Severity
5.3
First published (updated )
CVE-2026-42051

composer/getkirby/cmsKirby: User avatar creation, replacement and deletion are not gated by user update permissions

Risk 26
Severity
5.3
First published (updated )
CVE-2026-42174

composer/getkirby/cmsKirby: Read access to site, user and role information is not gated by permissions

Risk 40
Severity
7.1
First published (updated )
CVE-2026-42069

composer/getkirby/cmsKirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Risk 40
Severity
7.1
First published (updated )
CVE-2026-42137

composer/getkirby/cmsKirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

Risk 79
Severity
7.1
First published (updated )
CVE-2026-41325
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

Risk 38
Severity
5.3
First published (updated )
CVE-2026-40099

composer/getkirby/cmsKirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

Risk 60
Severity
7.6
First published (updated )
CVE-2026-34587

composer/getkirby/cmsKirby has XML injection in its XML creator toolkit

Risk 43
Severity
6.9
First published (updated )
CVE-2026-32870

Kirby Kirby CMSInput Validation

Risk 38
Severity
6.5
First published (updated )
CVE-2026-29905

kirby/kirbyKirby is missing permission checks in the content changes API

Risk 30
Severity
5.8
EPSS
0.03%
First published (updated )
CVE-2026-21896
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby CMS has cross-site scripting (XSS) in the changes dialog

Risk 34
Severity
5.4
First published (updated )
CVE-2025-65012

composer/getkirby/cmsPath traversal of collection names during file system lookup

Risk 66
Severity
9.1
First published (updated )
CVE-2025-31493

composer/getkirby/cmsKirby vulnerable to path traversal in the router for PHP's built-in server

Risk 43
Severity
7.5
First published (updated )
CVE-2025-30207

composer/getkirby/kirbyKirby vulnerable to path traversal of snippet names in the `snippet()` helper

Risk 66
Severity
9.1
First published (updated )
CVE-2025-30159

composer/getkirby/cmsInsufficient permission checks in the language settings in Kirby CMS

Risk 62
Severity
8.1
First published (updated )
CVE-2024-41964
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby cross-site scripting (XSS) in the link field "Custom" type

Risk 25
Severity
5.4
EPSS
0.04%
First published (updated )
CVE-2024-27087

composer/getkirby/cmsAn HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: …

Risk 39
Severity
7.1
EPSS
0.04%
First published (updated )
CVE-2024-26482

composer/getkirby/cmsXSS, Code Injection

Risk 57
Severity
8.8
EPSS
0.04%
First published (updated )
CVE-2024-26483

composer/getkirby/cmsXSS

Risk 24
Severity
4.7
EPSS
0.04%
First published (updated )
CVE-2024-26481

Kirby Kirby CMSXSS

Risk 27
Severity
6.1
EPSS
0.04%
First published (updated )
CVE-2024-26484
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

composer/getkirby/cmsKirby vulnerable to denial of service from unlimited password lengths

Risk 44
Severity
7.5
First published (updated )
CVE-2023-38492

composer/getkirby/cmsKirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

Risk 34
Severity
5.7
First published (updated )
CVE-2023-38491

composer/getkirby/cmsKirby XML External Entity (XXE) vulnerability in the XML data handler

Risk 74
Severity
10
First published (updated )
CVE-2023-38490

composer/getkirby/cmsKirby vulnerable to Insufficient Session Expiration after a password change

Risk 55
Severity
7.3
First published (updated )
CVE-2023-38489

composer/getkirby/cmsKirby vulnerable to field injection in the KirbyData text storage handler

Risk 80
Severity
8.8
First published (updated )
CVE-2023-38488
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

getkirby Webmentions Kirbybastianallgeier Kirby Webmentions Plugin injection

Risk 86
Severity
9.8
First published (updated )
CVE-2017-20174

getkirby KirbyKirby CMS vulnerable to user enumeration in the brute force protection

Risk 40
Severity
6.5
First published (updated )
CVE-2022-39315

getkirby KirbyUser enumeration in the code-based login and password reset forms

Risk 32
Severity
4.8
First published (updated )
CVE-2022-39314

getkirby KirbyCross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

Risk 42
Severity
5.9
First published (updated )
CVE-2022-36037

getkirby KirbyCSRF

Risk 22
Severity
4.3
First published (updated )
CVE-2018-14519
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203