# cve.now: Kiteworks

The newest entries naming Kiteworks as an affected vendor (up to 200), of 86 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-84473](https://cve.now/CVE-2026-84473.md): CVE-2026-84473 (CVSS 9.8)
- [CVE-2026-102105](https://cve.now/CVE-2026-102105.md): Kiteworks Email Protection Gateway server-side request forgery (CVSS 9.1)
- [CVE-2026-102106](https://cve.now/CVE-2026-102106.md): Kiteworks Email Protection Gateway improper authentication (CVSS 9.1)
- [CVE-2026-102107](https://cve.now/CVE-2026-102107.md): Kiteworks Core user impersonation in a file-request feature (CVSS 4.6)
- [CVE-2026-102108](https://cve.now/CVE-2026-102108.md): Kiteworks Email Protection Gateway deserialization of untrusted data (CVSS 7.2)
- [CVE-2026-102109](https://cve.now/CVE-2026-102109.md): Kiteworks Secure Data Forms SQL injection (CVSS 7.1)
- [CVE-2026-102110](https://cve.now/CVE-2026-102110.md): Missing authentication on a Kiteworks appliance setup function (CVSS 5.9)
- [CVE-2026-102111](https://cve.now/CVE-2026-102111.md): Kiteworks Core Improper Validation of Specified Quantity in Input (CVSS 4.9)
- [CVE-2026-102112](https://cve.now/CVE-2026-102112.md): Kiteworks Core Local Privilege Escalation (CVSS 7.8)
- [CVE-2026-102113](https://cve.now/CVE-2026-102113.md): Kiteworks Core Local Privilege Escalation (CVSS 7.8)
- [CVE-2026-102114](https://cve.now/CVE-2026-102114.md): Kiteworks Core OS Command Injection (CVSS 7.2)
- [CVE-2026-102115](https://cve.now/CVE-2026-102115.md): Kiteworks Core Authentication Bypass in the Password Reset Workflow (CVSS 9.8)
- [CVE-2026-102116](https://cve.now/CVE-2026-102116.md): Kiteworks Email Protection Gateway Path Traversal (CVSS 7.2)
- [CVE-2026-102117](https://cve.now/CVE-2026-102117.md): Kiteworks Core Remote Code Execution (CVSS 7.2)
- [CVE-2026-102118](https://cve.now/CVE-2026-102118.md): Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation (CVSS 7.8)
- [CVE-2026-102119](https://cve.now/CVE-2026-102119.md): Kiteworks Email Protection Gateway Path Traversal (CVSS 7.2)
- [CVE-2026-102120](https://cve.now/CVE-2026-102120.md): Kiteworks Core OS Command Injection (CVSS 8.8)
- [CVE-2026-102121](https://cve.now/CVE-2026-102121.md): Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor (CVSS 8.6)
- [CVE-2026-102104](https://cve.now/CVE-2026-102104.md): Kiteworks Email Protection Gateway server-side request forgery (CVSS 9.1)
- [CVE-2026-102122](https://cve.now/CVE-2026-102122.md): Kiteworks Core Incorrect Authorization (CVSS 4.3)
- [CVE-2026-102123](https://cve.now/CVE-2026-102123.md): Kiteworks Core Path Traversal (CVSS 7.4)
- [CVE-2026-102103](https://cve.now/CVE-2026-102103.md): Kiteworks Email Protection Gateway server-side request forgery (CVSS 9.1)
- [CVE-2026-102124](https://cve.now/CVE-2026-102124.md): Kiteworks Core Missing Authentication for Critical Function (CVSS 6.5)
- [CVE-2026-102125](https://cve.now/CVE-2026-102125.md): Kiteworks Core Sandbox Escape (CVSS 8.8)
- [CVE-2026-102126](https://cve.now/CVE-2026-102126.md): Kiteworks Core Stored Cross-site Scripting (XSS) (CVSS 8.1)
- [CVE-2026-102127](https://cve.now/CVE-2026-102127.md): Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference (CVSS 7.0)
- [CVE-2026-102128](https://cve.now/CVE-2026-102128.md): Kiteworks Email Protection Gateway Improper Authentication (CVSS 7.5)
- [CVE-2026-102129](https://cve.now/CVE-2026-102129.md): Kiteworks Core Incorrect Privilege Assignment (CVSS 7.2)
- [CVE-2026-102130](https://cve.now/CVE-2026-102130.md): Kiteworks Email Protection Gateway Remote Code Execution (CVSS 7.2)
- [CVE-2026-102131](https://cve.now/CVE-2026-102131.md): Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity (CVSS 7.2)
- [CVE-2026-102132](https://cve.now/CVE-2026-102132.md): Kiteworks Core Privilege Escalation through Improper Access Control (CVSS 7.2)
- [CVE-2026-102133](https://cve.now/CVE-2026-102133.md): Kiteworks Core Arbitrary File Write through Command Injection (CVSS 6.6)
- [CVE-2026-102102](https://cve.now/CVE-2026-102102.md): Kiteworks Email Protection Gateway server-side request forgery (CVSS 9.1)
- [CVE-2026-102134](https://cve.now/CVE-2026-102134.md): Kiteworks Core Unprotected Alternate Channel (CVSS 5.4)
- [CVE-2026-102135](https://cve.now/CVE-2026-102135.md): Kiteworks Email Protection Gateway Deserialization of Untrusted Data (CVSS 6.6)
- [CVE-2026-102136](https://cve.now/CVE-2026-102136.md): Kiteworks Core Command Execution through Configuration Injection (CVSS 6.3)
- [CVE-2026-102137](https://cve.now/CVE-2026-102137.md): Kiteworks Core Unrestricted Upload of File with Dangerous Type (CVSS 4.1)
- [CVE-2026-102138](https://cve.now/CVE-2026-102138.md): Kiteworks Core Server-Side Request Forgery (SSRF) (CVSS 3.3)
- [CVE-2026-102101](https://cve.now/CVE-2026-102101.md): Kiteworks Core deserialization of untrusted data (CVSS 8.1)
- [CVE-2026-102139](https://cve.now/CVE-2026-102139.md): Kiteworks Email Protection Gateway Incorrect Authorization (CVSS 6.5)
- [CVE-2026-102140](https://cve.now/CVE-2026-102140.md): Kiteworks Core Insufficient Verification of Data Authenticity (CVSS 4.9)
- [CVE-2026-102141](https://cve.now/CVE-2026-102141.md): Kiteworks Core Privilege Escalation through External Control of File Name or Path (CVSS 6.7)
- [CVE-2026-102142](https://cve.now/CVE-2026-102142.md): Kiteworks Core Remote Code Execution through Server-Side Template Injection (CVSS 7.2)
- [CVE-2026-102143](https://cve.now/CVE-2026-102143.md): Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type (CVSS 7.5)
- [CVE-2026-102100](https://cve.now/CVE-2026-102100.md): Kiteworks Core stored XSS (CVSS 8.7)
- [CVE-2026-102144](https://cve.now/CVE-2026-102144.md): Kiteworks Email Protection Gateway Uncontrolled Resource Consumption (CVSS 5.3)
- [CVE-2026-102150](https://cve.now/CVE-2026-102150.md): Kiteworks Secure Data Forms Missing Authentication for Critical Function (CVSS 7.2)
- [CVE-2026-102149](https://cve.now/CVE-2026-102149.md): Kiteworks Email Protection Gateway Improper Access Control (CVSS 9.4)
- [CVE-2026-102147](https://cve.now/CVE-2026-102147.md): Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) (CVSS 9.3)
- [CVE-2026-102146](https://cve.now/CVE-2026-102146.md): Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection (CVSS 6.5)
- [CVE-2026-102145](https://cve.now/CVE-2026-102145.md): Kiteworks Core Server-Side Request Forgery through CRLF Injection (CVSS 6.6)
- [CVE-2026-102097](https://cve.now/CVE-2026-102097.md): Kiteworks Email Protection Gateway remote code execution (CVSS 7.2)
- [CVE-2026-102096](https://cve.now/CVE-2026-102096.md): Kiteworks Core OS command injection (CVSS 7.2)
- [CVE-2026-102099](https://cve.now/CVE-2026-102099.md): Kiteworks Core arbitrary file write (CVSS 7.2)
- [CVE-2026-102095](https://cve.now/CVE-2026-102095.md): Kiteworks Email Protection Gateway server-side request forgery (CVSS 9.1)
- [CVE-2026-102094](https://cve.now/CVE-2026-102094.md): Kiteworks Email Protection Gateway unsafe reflection (CVSS 7.2)
- [CVE-2026-102093](https://cve.now/CVE-2026-102093.md): Kiteworks Core improper privilege management (CVSS 7.2)
- [CVE-2026-102092](https://cve.now/CVE-2026-102092.md): Kiteworks Core stored XSS (CVSS 8.7)
- [CVE-2026-102091](https://cve.now/CVE-2026-102091.md): Kiteworks Secure Data Forms server-side request forgery (CVSS 7.5)
- [CVE-2026-102090](https://cve.now/CVE-2026-102090.md): Kiteworks Core content injection (CVSS 4.3)
- [CVE-2026-102098](https://cve.now/CVE-2026-102098.md): Kiteworks Core SQL Injection (CVSS 7.2)
- [CVE-2026-102089](https://cve.now/CVE-2026-102089.md): Kiteworks Email Protection Gateway path traversal (CVSS 7.2)
- [CVE-2026-24782](https://cve.now/CVE-2026-24782.md): Kiteworks Secure Data Forms has a SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-24761](https://cve.now/CVE-2026-24761.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 3.7)
- [CVE-2026-24756](https://cve.now/CVE-2026-24756.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 4.3)
- [CVE-2026-24755](https://cve.now/CVE-2026-24755.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 5.4)
- [CVE-2026-24754](https://cve.now/CVE-2026-24754.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 5.4)
- [CVE-2026-24753](https://cve.now/CVE-2026-24753.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5)
- [CVE-2026-24752](https://cve.now/CVE-2026-24752.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2)
- [CVE-2026-24751](https://cve.now/CVE-2026-24751.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2)
- [CVE-2026-23638](https://cve.now/CVE-2026-23638.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5)
- [CVE-2026-29092](https://cve.now/CVE-2026-29092.md): Kiteworks Email Protection Gateway has an Insufficient Session Expiration (CVSS 4.9)
- [CVE-2026-23636](https://cve.now/CVE-2026-23636.md): Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type (CVSS 5.5)
- [CVE-2026-23635](https://cve.now/CVE-2026-23635.md): Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials (CVSS 6.5)
- [CVE-2026-24750](https://cve.now/CVE-2026-24750.md): Kiteworks Secure Data Forms vulnerable to Cross-site Scripting (CVSS 7.6)
- [CVE-2026-23514](https://cve.now/CVE-2026-23514.md): Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management (CVSS 8.8)
- [CVE-2026-28272](https://cve.now/CVE-2026-28272.md): Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability (CVSS 8.1)
- [CVE-2026-28271](https://cve.now/CVE-2026-28271.md): Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 6.5)
- [CVE-2026-28270](https://cve.now/CVE-2026-28270.md): Kiteworks Core has an Unrestricted Upload of File with Dangerous Type (CVSS 4.9)
- [CVE-2026-28269](https://cve.now/CVE-2026-28269.md): Kiteworks Core has an OS Command Injection (CVSS 5.9)
- [CVE-2025-53939](https://cve.now/CVE-2025-53939.md): Kiteworks Core is vulnerable to Improper Input Validation (CVSS 6.3)
- [CVE-2025-53900](https://cve.now/CVE-2025-53900.md): Kiteworks MFT has a Privilege Defined With Unsafe Actions (CVSS 6.5)
- [CVE-2025-53899](https://cve.now/CVE-2025-53899.md): Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel (CVSS 7.2)
- [CVE-2025-53897](https://cve.now/CVE-2025-53897.md): Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.8)
- [CVE-2025-53896](https://cve.now/CVE-2025-53896.md): Kiteworks MFT is vulnerable to Insufficient Session Expiration (CVSS 7.1)
- [CVE-2023-7273](https://cve.now/CVE-2023-7273.md): Cross Site Request Forgery in Kiteworks OwnCloud (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kiteworks
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.