CVE-2026-102100

Kiteworks Core versions prior to 9.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This weakness allows an authenticated user to submit malicious content that executes arbitrary JavaScript when viewed by another user within their authenticated session. Such exploitation could enab...

CVE-2026-102100 Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2026-102144 Kiteworks Email Protection Gateway Uncontrolled Resource Consumption

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service...

CVE-2026-102144 Kiteworks Email Protection Gateway Uncontrolled Resource Consumption

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service...

CVE-2026-102144

The Kiteworks Email Protection Gateway is vulnerable to a resource exhaustion flaw. An unauthenticated remote attacker can repeatedly trigger a comparatively expensive server-side operation, resulting in a partial denial of service . No specific exploit information or remediation details are prov...

EUVD-2026-90268

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2026-102150

A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

EUVD-2026-90385

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102149 Kiteworks Email Protection Gateway Improper Access Control

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102149

The Kiteworks Email Protection Gateway is vulnerable to an improper access control issue because it fails to sufficiently restrict which account a certificate can be assigned to. An attacker could exploit this to associate a certificate with another user's account, compromising the confidentialit...

CVE-2026-102149 Kiteworks Email Protection Gateway Improper Access Control

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102147 Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

A stored cross-site scripting XSS weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full...

CVE-2026-102147

A stored cross-site scripting (XSS) weakness exists in Kiteworks Core that allows an unauthenticated attacker to inject and store crafted content. When an administrator views the affected page, the content executes arbitrary JavaScript within their authenticated session. This vulnerability could ...

CVE-2026-102147 Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

A stored cross-site scripting XSS weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full...

CVE-2026-102146 Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102146

The Kiteworks Email Protection Gateway is vulnerable to an Arbitrary File Write vulnerability caused by Server-Side Template Injection . An authenticated administrator with limited, delegated permissions can exploit this to write files with attacker-controlled content to arbitrary locations acces...

CVE-2026-102146 Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...