Known vulnerabilities in Kirby

Software: Kirby
Software CPE: cpe:2.3:a:iandstewart:kirby:*:*:*:*:*:wordpress:*:*
Total vulnerabilities: 54
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Kirby Kirby is affected by 54 known vulnerabilities: 3 high, 20 medium, 31 low Critical High Medium Low

Vulnerabilities (54)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138448 - Missing Authorization
CVE-2026-71415
CWE-862 Low
No
No
5.5.2 20.07.2026 SB2026072036
#VU138447 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-75592
CWE-22 Low
No
No
4.9.5, 5.5.2 20.07.2026 SB2026072036
#VU138446 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-75594
CWE-22 Medium
No
No
4.9.5, 5.5.2 20.07.2026 SB2026072036
#VU138445 - Exposure of Sensitive System Information to an Unauthorized Control Sphere
CVE-2026-69127
CWE-497 Medium
No
No
4.9.5, 5.5.2 20.07.2026 SB2026072036
#VU138444 - Missing Authorization
CVE-2026-49274
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138443 - Improper Neutralization of Script in Attributes in a Web Page
CVE-2026-49276
CWE-83 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138442 - Missing Authorization
CVE-2026-54004
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138441 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-50188
CWE-113 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138440 - Missing Authorization
CVE-2026-54005
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138439 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54002
CWE-79 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138437 - External Initialization of Trusted Variables or Data Stores
CVE-2026-54003
CWE-454 High
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU132144 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2026-44174
CWE-470 Medium
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU132143 - Missing Authorization
CVE-2026-44176
CWE-862 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU132142 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2026-44177
CWE-98 Medium
No
No
5.4.1 22.05.2026 SB2026052274
#VU132141 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45368
CWE-79 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU132139 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44175
CWE-79 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU132137 - Missing Authorization
CVE-2026-45334
CWE-862 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU127199 - XML Injection
CVE-2026-32870
CWE-91 High
No
No
4.9.0, 5.4.0 23.04.2026 SB20260423151
#VU127198 - Missing Authorization
CVE-2026-42069
CWE-862 Low
No
No
4.9.0, 5.4.0 23.04.2026 SB20260423151
#VU127197 - Missing Authorization
CVE-2026-42051
CWE-862 Low
No
No
4.9.0, 5.4.0 23.04.2026 SB20260423151


Showing elements 1 - 20 out of 54