Core (Kiteworks) - vulnerabilities (CVEs)

36 CVEs, 35 in the last 30 days, 2 known versions, newest CVE from 2026-09-30. Vendor: Kiteworks.

CVEs of Core

• CVE-2026-102107 - CVSS 4.6 (medium), 2026-09-30: Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate…
• CVE-2026-102110 - CVSS 5.9 (medium), 2026-09-30: An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the…
• CVE-2026-102111 - CVSS 4.9 (medium), 2026-09-30: Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside…
• CVE-2026-102112 - CVSS 7.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account…
• CVE-2026-102113 - CVSS 7.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account…
• CVE-2026-102114 - CVSS 7.2 (high), 2026-09-30: A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as…
• CVE-2026-102115 - CVSS 9.8 (critical), 2026-09-30: Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a…
• CVE-2026-102117 - CVSS 7.2 (high), 2026-09-30: On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the…
• CVE-2026-102118 - CVSS 7.8 (high), 2026-09-30: A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to…
• CVE-2026-102120 - CVSS 8.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks…
• CVE-2026-102122 - CVSS 4.3 (medium), 2026-09-30: Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding…
• CVE-2026-102123 - CVSS 7.4 (high), 2026-09-30: A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to…
• CVE-2026-102124 - CVSS 6.5 (medium), 2026-09-30: A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with…
• CVE-2026-102125 - CVSS 8.8 (high), 2026-09-30: The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that…
• CVE-2026-102126 - CVSS 8.1 (high), 2026-09-30: A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to…
• CVE-2026-102129 - CVSS 7.2 (high), 2026-09-30: A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An…
• CVE-2026-102132 - CVSS 7.2 (high), 2026-09-30: An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration…
• CVE-2026-102133 - CVSS 6.6 (medium), 2026-09-30: An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing…
• CVE-2026-102134 - CVSS 5.4 (medium), 2026-09-30: Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An…
• CVE-2026-102136 - CVSS 6.3 (medium), 2026-09-30: In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster…
• CVE-2026-102137 - CVSS 4.1 (medium), 2026-09-30: An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on…
• CVE-2026-102138 - CVSS 3.3 (low), 2026-09-30: An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved…
• CVE-2026-102101 - CVSS 8.1 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain…
• CVE-2026-102140 - CVSS 4.9 (medium), 2026-09-30: An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only…
• CVE-2026-102141 - CVSS 6.7 (medium), 2026-09-30: Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could…
• CVE-2026-102142 - CVSS 7.2 (high), 2026-09-30: A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body.…
• CVE-2026-102100 - CVSS 8.7 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow…
• CVE-2026-102147 - CVSS 9.3 (critical), 2026-09-30: A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary…
• CVE-2026-102145 - CVSS 6.6 (medium), 2026-09-30: An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable…
• CVE-2026-102096 - CVSS 7.2 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose…
• CVE-2026-102099 - CVSS 7.2 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative…
• CVE-2026-102093 - CVSS 7.2 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could…
• CVE-2026-102092 - CVSS 8.7 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that…
• CVE-2026-102090 - CVSS 4.3 (medium), 2026-09-30: Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an…
• CVE-2026-102098 - CVSS 7.2 (high), 2026-09-30: Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could…
• CVE-2026-23514 - CVSS 8.8 (high), 2026-03-25: Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to…