CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

45 matches found

Positive Technologies•added 2026/05/27 12:0 a.m.•3 views

PT-2026-44153

TL;DR This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the users.access or users.list permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role's blueprint sets...

5.3CVSS5.6AI score

Exploits0References5

OSV•added 2026/05/26 11:55 p.m.•4 views

GHSA-2XW4-V2WX-HQQ9 Kirby CMS's `pages.access` permission is not checked during rendering of page drafts

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages pages.access permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or via a combination of both settings. Kirby sites...

6CVSS5.7AI score

Exploits0References4

Github Security Blog•added 2026/05/26 11:55 p.m.•10 views

Kirby CMS's `pages.access` permission is not checked during rendering of page drafts

5.7AI score

Exploits0References4Affected Software1

Positive Technologies•added 2026/05/26 12:0 a.m.•5 views

PT-2026-43451

6CVSS5.7AI score

Exploits0References5

Github Security Blog•added 2026/05/04 7:58 p.m.•4 views

Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to update user information user.update or users.update permission is disabled. This can be due to configuration in the blueprints of the acting users, via options in the blueprints of the target...

5.3CVSS5.7AI score0.00008EPSS

Exploits0References5Affected Software1

OSV•added 2026/04/30 9:3 p.m.•2 views

GHSA-85X2-R8XV-WW8C Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or list pages or files pages.access, pages.list, files.access or files.list permission is disabled. This can be due to configuration in the user blueprints, via options in the model...

7.1CVSS5.7AI score0.0001EPSS

Exploits0References4

EUVD•added 2026/04/24 12:23 a.m.•2 views

EUVD-2026-25369

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint site/blueprints/users/.... ...

7.6CVSS5.2AI score0.00033EPSS

Exploits0References3

ATTACKERKB•added 2026/04/24 12:23 a.m.•2 views

CVE-2026-34587

7.6CVSS5.6AI score0.00033EPSS

Exploits0References4Affected Software1

Positive Technologies•added 2026/04/24 12:0 a.m.•2 views

PT-2026-34818

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 Description Kirby is an open-source content management system where user permissions and model blueprint options control authorization for actions such as pages.create, files.create,...

8.8CVSS5.1AI score0.00041EPSS

Exploits0References10

Snyk•added 2026/04/21 6:31 p.m.•2 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the asset and blueprint file operations in the CMS and Tailor editor extensions. An attacker can gain unauthorized access to perform file operations such as create, delete, rename, move, or upload on theme...

3.3CVSS5.8AI score0.00033EPSS

Exploits0References2

OSV•added 2026/04/21 5:15 p.m.•0 views

GHSA-JVWG-PHXX-J3RP October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations

Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cmsassets or editor.tailorblueprints specifically withheld, an uncommon...

3.3CVSS5.7AI score0.00033EPSS

Exploits0References3

vulnersOsv•added 2026/02/06 3:31 p.m.•1 views

br.com.caelum.vraptor:vraptor-neo4j (=0.9.0), com.catify.bpmn:bpmn-engine-core (=1.1) +108 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (>=1.3 <=2025.09.0)

org.neo4j:neo4j MAVEN version =1.3, =0.1, =1.9-1.1, =1.0, =0.1, =0.2, =2.4, =2.9.1, =1.2, =1.2, =2.2.0 and more Source cves: CVE-2026-1337 Source advisory: OSV:GHSA-XR72-G735-4VWP...

5.4CVSS5.8AI score0.00012EPSS

Exploits2

RedhatCVE•added 2025/10/23 8:16 p.m.•3 views

CVE-2025-62247

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19...

6.5CVSS6.7AI score0.00047EPSS

Exploits0References1

Github Security Blog•added 2025/10/22 9:31 p.m.•4 views

Liferay Portal and DXP are Missing Authorization in Collection Provider

6.5CVSS6.8AI score0.00047EPSS

Exploits0References5Affected Software1

EUVD•added 2025/10/22 9:31 p.m.•3 views

EUVD-2025-35627

Liferay Portal and DXP are Missing Authorization in Collection Provider...

2CVSS6.4AI score0.00047EPSS

Exploits0References4

Snyk•added 2025/10/22 9:31 p.m.•2 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via SXPBlueprintInfoCollectionProvider.java. An attacker can gain unauthorized access to and select restricted Blueprints by exploiting insufficient authorization checks across instances. Remediation A fix was push...

6.5CVSS7AI score0.00047EPSS

Exploits0References2

OSV•added 2025/10/22 9:31 p.m.•3 views

GHSA-CQWV-9XH5-25FG Liferay Portal and DXP are Missing Authorization in Collection Provider

2CVSS6.8AI score0.00047EPSS

Exploits0References5