Kiwi

This hub aggregates every CVE we track for Kiwi. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Kiwi.

• CVE-2026-49292Kiwi TCMS: The /init-db/ page renders and responds to requests after first useSep 17, 2026
• CVE-2026-55630Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)Sep 15, 2026
• CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint6.1Sep 15, 2026
• CVE-2025-58790WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability6.5Sep 5, 2025
• CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox8.1Jul 5, 2023
• CVE-2023-33977Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS8.1Jun 6, 2023
• CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files upload8.1May 27, 2023
• CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow8.8Apr 24, 2023
• CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerability8.1Apr 24, 2023
• CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified one3.9Apr 24, 2023
• CVE-2023-27489Stored cross site scripting via SVG file upload in Kiwi TCMS7.6Mar 29, 2023
• CVE-2023-25171Kiwi TCMS has denial of service vulnerability on Password reset page7.5Feb 15, 2023
• CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login page7.5Feb 15, 2023
• CVE-2023-22451Weak password requirements in Kiwi TCMS6.5Jan 2, 2023
• CVE-2017-17532examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct a...8.8Dec 14, 2017