CVE-2026-42174

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.

• CWE-862

• https://github.com/getkirby/kirby/releases/tag/4.9.0Release Notes
• https://github.com/getkirby/kirby/releases/tag/5.4.0Release Notes
• https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2Patch, Vendor Advisory

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42168django-pyas2 through 1.2.3 is vulnerable to OS command injec…9.1
• CVE-2026-42169A heap-buffer-overflow vulnerability exists in the APNG (Ani…7.3
• CVE-2026-4217A security vulnerability has been detected in XREAL Nebula A…2.5
• CVE-2026-42170A heap-based buffer overflow vulnerability exists in the GIM…7.8
• CVE-2026-42171NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12…7.8
• CVE-2026-42172Coolify is an open-source and self-hostable tool for managin…3.1
• CVE-2026-42175requests-hardened is a library that overrides the default be…6.5
• CVE-2026-42176Scoold is a Q&A and a knowledge sharing platform for teams. …6.7
• CVE-2026-42177linux-entra-sso is a browser plugin for Linux to SSO on Micr…5.3
• CVE-2026-4218A vulnerability was detected in myAEDES App up to 1.18.4 on …2.5
• CVE-2026-42180Lemmy is a link aggregator and forum for the fediverse. Prio…6.3
• CVE-2026-42181Lemmy is a link aggregator and forum for the fediverse. Prio…6.5