Log in Start free

getkirby

Products

ProductCVEsExploitedLatest
Kirby47–Oct 12, 2026

Exploited and recent CVEs

  • CVE-2026-108924 Medium 4.3 getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization 0.3%
  • CVE-2026-75594 High 8.2 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling 0.8%
  • CVE-2026-75592 Medium 6.9 Kirby: Access to image files outside of the site root via path traversal in the media handling 0.7%
  • CVE-2026-71415 High 7.1 Kirby: File upload permissions are not checked during processing of chunk data 0.4%
  • CVE-2026-69127 Medium 6.9 Kirby: System path exposure from error messages in the REST API 0.7%
  • CVE-2026-45368 High 8.4 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend 0.5%
  • CVE-2026-45334 Medium 5.3 Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions 0.4%
  • CVE-2026-44175 High 8.5 Kirby: Cross-site scripting (XSS) from list field content in the site frontend 0.4%
  • CVE-2026-44176 Medium 6.0 Kirby: `pages.access` permission is not checked during rendering of page drafts 0.4%
  • CVE-2026-44177 High 8.8 Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup 1.8%
  • CVE-2026-44174 High 8.7 Kirby: Arbitrary Method Call via REST API search and collection query endpoints 0.5%
  • CVE-2026-49276 High 7.4 Kirby: Self cross-site scripting (self-XSS) in the writer field 0.4%
  • CVE-2026-54005 High 7.1 Kirby: `pages.access` permission is not checked in the `site/find` REST API route 0.4%
  • CVE-2026-50188 Medium 6.9 Kirby: Request header injection in `Http\Remote` 0.4%
  • CVE-2026-54004 Medium 6.3 Kirby: Access to files of top-level drafts is not protected by permissions 0.5%
  • CVE-2026-49274 Medium 5.3 Kirby: `pages.access` permission is not checked in the pages picker for parent pages 0.5%
  • CVE-2026-54003 Critical 9.1 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header 0.7%
  • CVE-2026-54002 High 8.5 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` 0.5%
  • CVE-2026-42174 Medium 5.3 Kirby: User avatar creation, replacement and deletion are not gated by user update permissions 0.2%
  • CVE-2026-42137 High 7.1 Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog 0.3%
  • CVE-2026-42051 Medium 5.3 Kirby: System API endpoint leaks license data and installed version to authenticated users 0.2%
  • CVE-2026-42069 High 7.1 Kirby: Read access to site, user and role information is not gated by permissions 0.2%
  • CVE-2026-41325 High 7.1 Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection 0.4%
  • CVE-2026-40099 Medium 5.3 Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter 0.3%
  • CVE-2026-34587 High 7.6 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering 0.3%
  • CVE-2026-32870 Medium 6.9 Kirby has XML injection in its XML creator toolkit 0.3%
  • CVE-2026-21896 Medium 5.8 Kirby is missing permission checks in the content changes API 0.2%
  • CVE-2025-65012 Medium 5.1 Kirby CMS has cross-site scripting (XSS) in the changes dialog 0.2%
  • CVE-2025-31493 Medium 6.3 Path traversal of collection names during file system lookup 0.6%
  • CVE-2025-30207 Low 2.3 Kirby vulnerable to path traversal in the router for PHP's built-in server 0.6%