CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102109

A SQL injection vulnerability exists in Kiteworks Secure Data Forms . The root cause is the improper sanitization of a value derived from an authenticated user's stored account data when incorporated into a database query. Exploitation requires an authenticated session and is only applicable to d...

EUVD-2026-90310

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102121

The Kiteworks Secure Data Forms product contains a vulnerability in its Advanced Forms component where the form-rendering interface is reachable without authentication. While published forms are intended for anonymous visitors, the interface returns excessive data beyond what is required for the ...

CVE-2026-102121 Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve th...

CVE-2026-102121 Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve th...

EUVD-2026-90372

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw allows an unauthenticated, remote attacker to compel the server to issue arbitrary outbound network requests and read back the responses. Such exploitation could enable the attacker ...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

Kiteworks multiple vulnerabilities

RECOMMENDED PRACTICES Fixed in version 9.5.0 and 9.5.1. 2. DESCRIPTION Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

UBUNTU-CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

EUVD-2026-90167

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

OESA-2026-4217 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.CVE-2023-49721...