CVE-2026-102114 Kiteworks Core OS Command Injection

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

EUVD-2026-90305

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102114

A command injection vulnerability exists in Kiteworks that allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges. No specific r...

CVE-2026-102120 Kiteworks Core OS Command Injection

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102120

A privilege escalation vulnerability exists in Kiteworks due to insufficient input validation within an internal cluster management function. This flaw allows an attacker who already has code execution on one node of a clustered Kiteworks deployment to execute operating system commands with eleva...

CVE-2026-102133

An optional, separately licensed repository-connector feature in Kiteworks Core is vulnerable to command injection because it fails to neutralize special characters in user-supplied paths before passing them to an external command. An authenticated system administrator can inject commands to writ...

CVE-2026-102133 Kiteworks Core Arbitrary File Write through Command Injection

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

CVE-2026-102133 Kiteworks Core Arbitrary File Write through Command Injection

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

EUVD-2026-90284

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

EUVD-2026-90379

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096

Kiteworks Core versions prior to 9.5.0 are vulnerable to an OS Command Injection flaw. The vulnerability exists because the system fails to sufficiently validate the contents of a configuration package uploaded by an authenticated administrator. A crafted package can trigger the execution of arbi...

CVE-2026-103473

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473

Deno versions 2.7.0 through 2.9.7 on Windows are vulnerable to a command injection flaw in the node:child_process component. The root cause is that shell arguments are incorrectly escaped for the wrong shell type. An attacker can inject OS commands by providing untrusted arguments when the shell ...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

EUVD-2026-90204

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

CVE-2026-103473 Deno 2.7.0 through 2.9.7 Command Injection via node:child_process

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:childprocess where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with...

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite ZCS to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 CVSS score: 8.9, an unauthenticated operating system comman...