CVE Vulnerability Database
Search and browse 425,079 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-102141 | MEDIUM | 6.7 | 0.1% | Sep 30, 2026 | Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding ro... |
| CVE-2026-102140 | MEDIUM | 4.9 | 0.1% | Sep 30, 2026 | An authenticated administrator could initiate an administrative import using a file whose contents were not fully verifi... |
| CVE-2026-102139 | MEDIUM | 6.5 | 0.3% | Sep 30, 2026 | An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establ... |
| CVE-2026-102138 | LOW | 3.3 | 0.2% | Sep 30, 2026 | An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a conne... |
| CVE-2026-102137 | MEDIUM | 4.1 | 0.3% | Sep 30, 2026 | An authenticated administrator could bypass the content validation applied to an administrative file upload and store a ... |
| CVE-2026-102136 | MEDIUM | 6.3 | 0.1% | Sep 30, 2026 | In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a valu... |
| CVE-2026-102135 | MEDIUM | 6.6 | 0.4% | Sep 30, 2026 | On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could ... |
| CVE-2026-102134 | MEDIUM | 5.4 | 0.2% | Sep 30, 2026 | Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform... |
| CVE-2026-102133 | MEDIUM | 6.6 | 0.4% | Sep 30, 2026 | An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in... |
| CVE-2026-102132 | HIGH | 7.2 | 0.3% | Sep 30, 2026 | An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to cre... |
| CVE-2026-102131 | HIGH | 7.2 | 0.4% | Sep 30, 2026 | Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every f... |
| CVE-2026-102130 | HIGH | 7.2 | 0.4% | Sep 30, 2026 | Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an admin... |
| CVE-2026-102129 | HIGH | 7.2 | 0.3% | Sep 30, 2026 | A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant t... |
| CVE-2026-102128 | HIGH | 7.5 | 0.2% | Sep 30, 2026 | An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks plat... |
| CVE-2026-102127 | HIGH | 7 | 0.2% | Sep 30, 2026 | An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional,... |
| CVE-2026-102126 | HIGH | 8.1 | 0.2% | Sep 30, 2026 | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narro... |
| CVE-2026-102125 | HIGH | 8.8 | 0.1% | Sep 30, 2026 | The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.... |
| CVE-2026-102124 | MEDIUM | 6.5 | 0.2% | Sep 30, 2026 | A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configurat... |
| CVE-2026-102123 | HIGH | 7.4 | 0.3% | Sep 30, 2026 | A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could a... |
| CVE-2026-102122 | MEDIUM | 4.3 | 0.2% | Sep 30, 2026 | Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configur... |
| CVE-2026-102121 | HIGH | 8.6 | 0.3% | Sep 30, 2026 | A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms c... |
| CVE-2026-102120 | HIGH | 8.8 | 0.1% | Sep 30, 2026 | A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution... |
| CVE-2026-102119 | HIGH | 7.2 | 0.5% | Sep 30, 2026 | A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to m... |
| CVE-2026-102118 | HIGH | 7.8 | 0.1% | Sep 30, 2026 | A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a lo... |
| CVE-2026-102117 | HIGH | 7.2 | 0.4% | Sep 30, 2026 | On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who al... |