CVE-2026-102110

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CVE-2026-102123 Kiteworks Core Path Traversal

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102123

A path traversal vulnerability exists in the Kiteworks appliance setup interface because the system fails to confine user-supplied file paths to their intended directory. An unauthenticated attacker with network access to the interface could write files to any location writable by the service acc...