Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.

Severity: All Critical High

Library: getkirby/cms

CVE-2026-44174 HIGH CVSS 8.7 Verified Advisory Jul 16, 2026

Arbitrary method call in Kirby's REST API search (CVE-2026-44174)

CVE-2026-44174 is an arbitrary method call vulnerability in Kirby's REST API search and collection query endpoints. Affected releases did not validate model attributes used in collection queries, allowing authenticate...

Fixed in 4.9.1; 5.4.1

RCE Information Disclosure Privilege Escalation

CVE-2026-44175 HIGH CVSS 8.5 Verified Advisory Jul 16, 2026

Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-44175)

CVE-2026-44175 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the list field and list block components. Insufficient HTML sanitization on save allows an authenticated Panel user with updat...

Fixed in 4.9.1; 5.4.1

XSS

CVE-2026-45368 HIGH CVSS 8.4 Verified Advisory Jul 16, 2026

Stored cross-site scripting (XSS) in Kirby CMS (CVE-2026-45368)

CVE-2026-45368 is a stored cross-site scripting (XSS) vulnerability in Kirby CMS affecting the `(link: …)` KirbyTag, the `link:` parameter of the `(image: …)` KirbyTag, the built-in image block with a link, and the HT...

Fixed in 4.9.1; 5.4.1

XSS