Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-17636 | high | 8.8 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to im... | 2026-10-08 |
| CVE-2026-102135 | medium | 6.6 | No | On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted ser... | 2026-10-08 |
| CVE-2026-102133 | medium | 6.6 | No | An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied pat... | 2026-10-08 |
| CVE-2026-102131 | high | 7.2 | No | Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they co... | 2026-10-08 |
| CVE-2026-102130 | high | 7.2 | No | Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influenc... | 2026-10-08 |
| CVE-2026-102129 | high | 7.2 | No | A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assign... | 2026-10-08 |
| CVE-2026-102128 | high | 7.5 | No | An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a... | 2026-10-08 |
| CVE-2026-102127 | high | 7.0 | No | An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message... | 2026-10-08 |
| CVE-2026-102125 | high | 8.8 | No | The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already execut... | 2026-10-08 |
| CVE-2026-102124 | medium | 6.5 | No | A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthentica... | 2026-10-08 |
| CVE-2026-102121 | high | 8.6 | No | A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a... | 2026-10-08 |
| CVE-2026-102116 | high | 7.2 | No | -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended locati... | 2026-10-08 |
| CVE-2026-102109 | high | 7.1 | No | A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account dat... | 2026-10-08 |
| CVE-2026-102108 | high | 7.2 | No | An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interf... | 2026-10-08 |
| CVE-2026-102106 | critical | 9.1 | No | Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protect... | 2026-10-08 |
| CVE-2026-102105 | critical | 9.1 | No | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (... | 2026-10-08 |
| CVE-2026-102104 | critical | 9.1 | No | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (... | 2026-10-08 |
| CVE-2026-102103 | critical | 9.1 | No | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (... | 2026-10-08 |
| CVE-2026-102102 | critical | 9.1 | No | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (... | 2026-10-08 |
| CVE-2026-102097 | high | 7.2 | No | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed a... | 2026-10-08 |