Known vulnerabilities in Kirby

Software: Kirby
Software CPE: cpe:2.3:a:iandstewart:kirby:*:*:*:*:*:wordpress:*:*
Total vulnerabilities: 65
Public exploits: 2
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Kirby Kirby is affected by 65 known vulnerabilities: 3 high, 21 medium, 41 low Critical High Medium Low

Vulnerabilities (65)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150668 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150667 - External Control of File Name or Path
CWE-73 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150666 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150665 - Improper Authentication
CWE-287 Medium
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150664 - Improper Neutralization of Alternate XSS Syntax
CWE-87 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150663 - Inclusion of Functionality from Untrusted Control Sphere
CWE-829 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150662 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150661 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150659 - Incorrect Behavior Order: Validate Before Canonicalize
CWE-180 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150660 - Incorrect Behavior Order: Validate Before Canonicalize
CWE-180 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU150658 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
4.9.6, 5.6.0 17.09.2026 SB20260917227
#VU138444 - Missing Authorization
CVE-2026-49274
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138443 - Improper Neutralization of Script in Attributes in a Web Page
CVE-2026-49276
CWE-83 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138442 - Missing Authorization
CVE-2026-54004
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138441 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-50188
CWE-113 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138440 - Missing Authorization
CVE-2026-54005
CWE-862 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138439 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-54002
CWE-79 Low
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU138437 - External Initialization of Trusted Variables or Data Stores
CVE-2026-54003
CWE-454 High
No
No
4.9.4, 5.4.4 20.07.2026 SB2026072035
#VU132139 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44175
CWE-79 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274
#VU132137 - Missing Authorization
CVE-2026-45334
CWE-862 Low
No
No
4.9.1, 5.4.1 22.05.2026 SB2026052274


Showing elements 1 - 20 out of 65