https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T00:51:58.375689+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54003 CVE-2026-54003 — Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header 2026-10-06T00:51:58.391764+00:00

Affected: getkirby kirby

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.