Media
CVE-2026-75592
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 51
Restablecer filtros
Media
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
Alta
CVE-2026-71415
Kirby: File upload permissions are not checked during processing of chunk data
Alta
CVE-2026-75594
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Alta
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Media
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Crítica
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Alta
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Media
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
Alta
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Media
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
Alta
CVE-2026-45368
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Media
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
Alta
CVE-2026-44177
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Media
CVE-2026-44176
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
Alta
CVE-2026-44175
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
Alta
CVE-2026-44174
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
Media
CVE-2026-42051
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
Media
CVE-2026-42174
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
Alta
CVE-2026-42069
Kirby CMS's read access to site, user and role information is not gated by permissions
Alta
CVE-2026-42137
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
Alta
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Media
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
Alta
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.