CVE-2026-42137

Kirby CVE-2026-42137 affects the open-source Kirby CMS. Prior to versions 4.9.0 and 5.4.0, the Panel and REST API did not consistently enforce pages.access/list and files.access/list permissions, enabling missing authorization in some collections and related models. The issue has been fixed in Ki...

CVE-2026-42051

CVE-2026-42051 affects Kirby CMS. The issue: the /api/system endpoint exposed installed Kirby version and license data to authenticated users due to missing authorization. It is patched in Kirby 4.9.0 and 5.4.0, with the fix enforcing the access.system permission to restrict exposure. Impact is а...

CVE-2026-42051 Kirby: System API endpoint leaks license data and installed version to authenticated users

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-42051 Kirby: System API endpoint leaks license data and installed version to authenticated users

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-42051 Kirby: System API endpoint leaks license data and installed version to authenticated users

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-8115

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The...

CVE-2026-30496

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration 74 endpoints and writing/modifying settings including volume, mute,...

CVE-2025-69691

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.execphp. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code...

CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-postgresql, bazelisk, dask-gateway, grafana-alloy, apko, dive, buildkitd, zot, aws-flb-firehose, prometheus, container-object-storage-interface, argo-workflows, litefs, nri-apache, pdfcpu,...

GHSA-2283-WF8C-RW8R vulnerabilities

Vulnerabilities for packages: go, kubevela, cloud-sql-proxy, rancher-helm, dask-gateway, grafana-alloy, apko, buildkitd, zot, aws-flb-firehose, prometheus, argo-workflows, tetragon, goreleaser, telegraf, step-ca, gatekeeper, cilium-cli, thanos, aactl, prometheus-pushgateway, trino,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-postgresql, bazelisk, tempo, dask-gateway, grafana-alloy, apko, dive, buildkitd, zot, aws-flb-firehose, prometheus, container-object-storage-interface, argo-workflows, litefs, nri-apache, pdfcpu,...

CVE-2026-42501 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-postgresql, bazelisk, tempo, dask-gateway, grafana-alloy, apko, dive, buildkitd, zot, aws-flb-firehose, prometheus, container-object-storage-interface, argo-workflows, litefs, nri-apache, pdfcpu,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-postgresql, bazelisk, tempo, dask-gateway, grafana-alloy, apko, dive, buildkitd, zot, aws-flb-firehose, prometheus, container-object-storage-interface, argo-workflows, litefs, nri-apache, pdfcpu,...

GHSA-QF3Q-3H68-MMH2 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-postgresql, bazelisk, tempo, dask-gateway, grafana-alloy, apko, dive, buildkitd, zot, aws-flb-firehose, prometheus, container-object-storage-interface, argo-workflows, litefs, nri-apache, pdfcpu,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: go, kubevela, cloud-sql-proxy, rancher-helm, dask-gateway, grafana-alloy, apko, buildkitd, zot, aws-flb-firehose, prometheus, argo-workflows, tetragon, goreleaser, telegraf, step-ca, gatekeeper, cilium-cli, thanos, aactl, prometheus-pushgateway, trino,...

GHSA-P9H5-JM8X-MJM5 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, dask-gateway, grafana-alloy, zot, aws-flb-firehose, prometheus, goreleaser, telegraf, gatekeeper, cilium-cli, thanos, aactl, nfpm, pgtimetable, trino, libnvidia-container, azure-service-operator, falco-no-driver, minio-object-browser,...

GHSA-XQ5J-9R39-C3VF vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, dask-gateway, grafana-alloy, zot, aws-flb-firehose, prometheus, goreleaser, telegraf, gatekeeper, cilium-cli, thanos, aactl, nfpm, pgtimetable, trino, libnvidia-container, azure-service-operator, falco-no-driver, minio-object-browser,...

CVE-2026-42499 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, dask-gateway, grafana-alloy, zot, aws-flb-firehose, prometheus, goreleaser, telegraf, gatekeeper, cilium-cli, thanos, aactl, nfpm, pgtimetable, trino, libnvidia-container, azure-service-operator, falco-no-driver, minio-object-browser,...

CVE-2026-39820 vulnerabilities

Vulnerabilities for packages: nats, go, kubevela, dask-gateway, grafana-alloy, zot, aws-flb-firehose, prometheus, goreleaser, telegraf, gatekeeper, cilium-cli, thanos, aactl, nfpm, pgtimetable, trino, libnvidia-container, azure-service-operator, falco-no-driver, minio-object-browser,...

Kirby 安全漏洞

Kirby is a set of open-source content management systems based on files. Versions of Kirby prior to 4.9.0 and 5.4.0 have security vulnerabilities. These vulnerabilities stem from insufficient checks for consistency in permissions for functions like Panel and REST API’s pages.access/list and...