Kiwi

This hub aggregates every CVE we track for Kiwi. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Kiwi.

• CVE-2025-58790WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability6.5Sep 5, 2025
• CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox8.1Jul 5, 2023
• CVE-2023-33977Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS8.1Jun 6, 2023
• CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files upload8.1May 27, 2023
• CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow8.8Apr 24, 2023
• CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerability8.1Apr 24, 2023
• CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified one3.9Apr 24, 2023
• CVE-2023-27489Stored cross site scripting via SVG file upload in Kiwi TCMS7.6Mar 29, 2023
• CVE-2023-25171Kiwi TCMS has denial of service vulnerability on Password reset page7.5Feb 15, 2023
• CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login page7.5Feb 15, 2023
• CVE-2023-22451Weak password requirements in Kiwi TCMS6.5Jan 2, 2023
• CVE-2017-17532examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct a...8.8Dec 14, 2017
• CVE-2011-3180kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters ...7.5Apr 16, 2014
• CVE-2011-4192kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double...7.5Apr 16, 2014
• CVE-2011-4195kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters ...7.5Apr 16, 2014