https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41325.htmlhttps://patchthecve.com/cve/CVE-2026-41325.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.8: Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize thttps://patchthecve.com/cve/CVE-2026-40099.htmlhttps://patchthecve.com/cve/CVE-2026-40099.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize thttps://patchthecve.com/cve/CVE-2026-34587.htmlhttps://patchthecve.com/cve/CVE-2026-34587.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.1: Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`).https://patchthecve.com/cve/CVE-2026-32870.htmlhttps://patchthecve.com/cve/CVE-2026-32870.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to t