CVE-2026-42051

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.

• CWE-862

• https://github.com/getkirby/kirby/releases/tag/4.9.0Release Notes
• https://github.com/getkirby/kirby/releases/tag/5.4.0Release Notes
• https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572Patch, Vendor Advisory

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42046libcaca is a colour ASCII art library. In 0.99.beta20 and ea…7.8
• CVE-2026-42047Inngest is a platform for running event-driven and scheduled…8.6
• CVE-2026-42048Langflow is a tool for building and deploying AI-powered age…9.6
• CVE-2026-42049jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inser…8.4
• CVE-2026-4205A vulnerability has been found in D-Link DNS-120, DNR-202L, …9.8
• CVE-2026-42050ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-42052Beets is the media library management system. Prior to versi…6
• CVE-2026-42055NGINX Plus and NGINX Open Source have a vulnerability in the…9.2
• CVE-2026-42058An authenticated attacker's undisclosed requests to BIG-IP i…5.3
• CVE-2026-4206A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-3…9.8
• CVE-2026-42061Local privilege escalation due to excessive permissions assi…7.3
• CVE-2026-42062ELECOM wireless LAN access point devices contain an OS comma…9.8