74039 matches found
CVE-2026-102129
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...
CVE-2026-102123
A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...
CVE-2026-102124
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...
CVE-2026-102108
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...
CVE-2026-103432
A flaw was found in apcupsd. A remote attacker could exploit a stack-based buffer overflow vulnerability in the web monitoring interface by supplying specially crafted data during variable parsing. A successful attack could allow the attacker to execute arbitrary code on the system or cause a...
CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...
CVE-2026-102108 Kiteworks Email Protection Gateway deserialization of untrusted data
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...
CVE-2026-102108
The Kiteworks Email Protection Gateway is vulnerable to a deserialization of untrusted data flaw. An authenticated administrator with specific queue-management privileges could submit a crafted serialized object to a cluster management interface . Due to insufficient validation during deserializa...
CVE-2026-102111 Kiteworks Core Improper Validation of Specified Quantity in Input
Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...
CVE-2026-102123
A path traversal vulnerability exists in the Kiteworks appliance setup interface because the system fails to confine user-supplied file paths to their intended directory. An unauthenticated attacker with network access to the interface could write files to any location writable by the service acc...
CVE-2026-102123 Kiteworks Core Path Traversal
A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...
CVE-2026-102123 Kiteworks Core Path Traversal
A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...
CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...
CVE-2026-102129 Kiteworks Core Incorrect Privilege Assignment
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...
CVE-2026-102129 Kiteworks Core Incorrect Privilege Assignment
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...
CVE-2026-102136
In multi-node deployments , a vulnerability exists where an attacker with existing code execution on one appliance node can submit values through an internal cluster interface . Due to insufficient validation, these values are written into the monitoring configuration of another node, potentially...
CVE-2026-102136 Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...
CVE-2026-102136 Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...
CVE-2026-31431-Metasploit-exploit
CVE-2026-31431 - Linuxカーネル AFALG "Copy Fail" ローカル権限昇格 CVE-2026-31431 （通称 "Copy Fail" ）を利用して、脆弱なLinuxカーネル（バージョン4.14から6.19.12）上でローカル権限昇格（LPE）を実行する、自動化されたMetasploitポストエクスプロイテーションモジュールです。 説明...