Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
ARETIQ Daily Vulnerability Bulletin — June 18, 2026 🔴 CRITICAL: CVE-2026-54003 (getkirby/cms) AAS 12.3 17 vulnerabilities — CRITICAL: 1, HIGH: 16 Full bulletin: https://aretiq.ai/bulletins/2026-06-18/
Post summary
The bulletin announces a critical vulnerability (CVE‑2026‑54003) in getkirby/cms, noting its severity level but providing no technical, exploit, or mitigation details.