CVE-2026-102110 Missing authentication on a Kiteworks appliance setup function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CVE-2026-102123 Kiteworks Core Path Traversal

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102123 Kiteworks Core Path Traversal

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102123

A path traversal vulnerability exists in the Kiteworks appliance setup interface because the system fails to confine user-supplied file paths to their intended directory. An unauthenticated attacker with network access to the interface could write files to any location writable by the service acc...

EUVD-2026-90295

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-102124

The Kiteworks appliance setup interface fails to enforce authentication after the initial configuration is complete. An unauthenticated attacker with network access can read and modify a limited set of setup records, specifically contact names and email addresses captured during the initial setup...

CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

EUVD-2026-90293

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-47501

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service,...

[SECURITY] Fedora 45 Update: gnome-initial-setup-51.0-1.fc45

GNOME Initial Setup is an alternative to firstboot, providing a good setup experience to welcome you to your system, and walks you through configuring it. It is integrated with gdm...

PT-2026-103557

Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A setup interface in the appliance fails to enforce authentication after the initial configuration process is complete. This allows an unauthenticated attacker with network access...

PT-2026-103556

Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A setup interface fails to properly confine user-supplied file paths to the intended directory. This allows an unauthenticated attacker with network access to the interface to wri...

PT-2026-103543

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint used during the initial appliance setup lacks authentication and fails to correctly enforce its intended state precondition. This allows an...

CVE-2026-102123: Improper Limitation of a Pathname to a Restricted Directory

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102124: Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-97409

A flaw was found in the Linux kernel's NVMe over Fibre Channel NVMe-FC driver. When establishing a connection to an NVMe-FC target, an administrative request timeout triggers error-handling routines that attempt to abort requests on uninitialized I/O queues. A malicious or unresponsive target cou...

CLEANSTART-2026-DD02110 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

PT-2026-108381

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...