Known vulnerabilities in Kiwi

Vendor: Kiwi TCMS
Software: Kiwi
Software CPE: cpe:2.3:a:kiwitcms:kiwi:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Kiwi Kiwi is affected by 23 known vulnerabilities: 2 high, 13 medium, 8 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU154041 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
16.6 09.10.2026 SB2026100946
#VU154040 - Missing Authorization
CWE-862 Medium
No
No
16.6 09.10.2026 SB2026100946
#VU150958 - Missing Authorization
CWE-862 Medium
No
No
16.5 18.09.2026 SB20260918161
#VU150957 - Improper input validation
CWE-20 Low
No
No
16.4 18.09.2026 SB20260918160
#VU150956 - Improper Neutralization of Special Elements in Data Query Logic
CWE-943 Low
No
No
16.4 18.09.2026 SB20260918160
#VU150955 - Insufficiently Protected Credentials
CWE-522 Medium
No
No
16.4 18.09.2026 SB20260918160
#VU150954 - Insufficiently Protected Credentials
CWE-522 Medium
No
No
16.3 18.09.2026 SB20260918159
#VU150952 - Missing Authorization
CVE-2026-49292
CWE-862 Low
No
No
16.0 18.09.2026 SB20260918158
#VU139249 - Improper input validation
CWE-20 Medium
No
No
16.2 23.07.2026 SB2026072373
#VU139248 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
16.2 23.07.2026 SB2026072373
#VU139247 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
16.2 23.07.2026 SB2026072373
#VU139244 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Medium
No
No
16.2 23.07.2026 SB2026072373
#VU135979 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55630
CWE-79 Low
No
No
16.1 30.06.2026 SB2026063064
#VU135976 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-54724
CWE-601 Medium
No
No
16.1 30.06.2026 SB2026063064
#VU150951 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-36809
CWE-79 Medium
No
No
12.5 04.07.2023 SB2023070450
#VU76449 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-32686
CWE-79 Low
No
No
12.3 23.05.2023 SB2023052327
#VU75689 - Unverified Ownership
CVE-2023-30544
CWE-283 Medium
No
No
12.2 03.05.2023 SB2023050309
#VU75688 - Unrestricted Upload of File with Dangerous Type
CVE-2023-30613
CWE-434 Medium
No
No
12.2 03.05.2023 SB2023050309
#VU75687 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-30628
CWE-78 High
No
No
834c86dfd1b2492ccad7ebbfd6304bfec895fed2 03.05.2023 SB2023050308
#VU150948 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-27489
CWE-79 Low
No
No
12.1 29.03.2023 SB2023032970


Showing elements 1 - 20 out of 23