Kiteworks - vulnerabilities (CVEs)
87 CVEs in 7 products, 61 in the last 30 days, newest from 2026-09-30.
Products
- Core - 36 CVEs
- Email Protection Gateway - 22 CVEs
- Secure Data Forms - 15 CVEs
- Security-advisories - 10 CVEs
- Totemomail - 2 CVEs
- Kiteworks Email Protection Gateway - 1 CVEs
- Owncloud - 1 CVEs
Newest CVEs of Kiteworks
- CVE-2026-102105 - CVSS 9.1 (critical), 2026-09-30: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in…
- CVE-2026-102106 - CVSS 9.1 (critical), 2026-09-30: Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did…
- CVE-2026-102107 - CVSS 4.6 (medium), 2026-09-30: Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate…
- CVE-2026-102108 - CVSS 7.2 (high), 2026-09-30: An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was…
- CVE-2026-102109 - CVSS 7.1 (high), 2026-09-30: A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated…
- CVE-2026-102110 - CVSS 5.9 (medium), 2026-09-30: An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the…
- CVE-2026-102111 - CVSS 4.9 (medium), 2026-09-30: Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside…
- CVE-2026-102112 - CVSS 7.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account…
- CVE-2026-102113 - CVSS 7.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account…
- CVE-2026-102114 - CVSS 7.2 (high), 2026-09-30: A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as…
- CVE-2026-102115 - CVSS 9.8 (critical), 2026-09-30: Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a…
- CVE-2026-102116 - CVSS 7.2 (high), 2026-09-30: -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the…
- CVE-2026-102117 - CVSS 7.2 (high), 2026-09-30: On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the…
- CVE-2026-102118 - CVSS 7.8 (high), 2026-09-30: A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to…
- CVE-2026-102119 - CVSS 7.2 (high), 2026-09-30: A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations…
- CVE-2026-102120 - CVSS 8.8 (high), 2026-09-30: A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks…
- CVE-2026-102121 - CVSS 8.6 (high), 2026-09-30: A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors,…
- CVE-2026-102104 - CVSS 9.1 (critical), 2026-09-30: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in…
- CVE-2026-102122 - CVSS 4.3 (medium), 2026-09-30: Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding…
- CVE-2026-102123 - CVSS 7.4 (high), 2026-09-30: A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to…
- CVE-2026-102103 - CVSS 9.1 (critical), 2026-09-30: Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in…
- CVE-2026-102124 - CVSS 6.5 (medium), 2026-09-30: A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with…
- CVE-2026-102125 - CVSS 8.8 (high), 2026-09-30: The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that…
- CVE-2026-102126 - CVSS 8.1 (high), 2026-09-30: A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to…
- CVE-2026-102127 - CVSS 7 (high), 2026-09-30: An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing…
- CVE-2026-102128 - CVSS 7.5 (high), 2026-09-30: An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not…
- CVE-2026-102129 - CVSS 7.2 (high), 2026-09-30: A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An…
- CVE-2026-102130 - CVSS 7.2 (high), 2026-09-30: Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the…
- CVE-2026-102131 - CVSS 7.2 (high), 2026-09-30: Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied.…
- CVE-2026-102132 - CVSS 7.2 (high), 2026-09-30: An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration…
