Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
15,012 results · Feed
-
High 8.8
Kiteworks Core Sandbox Escape
The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account tha…
-
High 8.1
Kiteworks Core Stored Cross-site Scripting (XSS)
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System …
-
High 7.0
Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read fil…
-
High 7.5
Kiteworks Email Protection Gateway Improper Authentication
An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, u…
-
High 7.2
Kiteworks Core Incorrect Privilege Assignment
A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full sy…
-
High 7.2
Kiteworks Email Protection Gateway Remote Code Execution
Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on…
-
High 7.2
Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choo…
-
High 7.2
Kiteworks Core Privilege Escalation through Improper Access Control
An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permiss…
-
Medium 6.6
Kiteworks Core Arbitrary File Write through Command Injection
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and …
-
High 8.7
pypdf: Possible large memory usage when retrieving alphabetical page labels
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application r…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gatew…
-
Medium 5.4
Kiteworks Core Unprotected Alternate Channel
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, in…
-
Medium 6.6
Kiteworks Email Protection Gateway Deserialization of Untrusted Data
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway …
-
Medium 6.3
Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, poten…
-
Medium 4.1
Kiteworks Core Unrestricted Upload of File with Dangerous Type
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnera…
-
Low 3.3
Kiteworks Core Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to inte…
-
High 8.1
Kiteworks Core deserialization of untrusted data
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code executio…
-
Medium 6.5
Kiteworks Email Protection Gateway Incorrect Authorization
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subj…
-
Medium 4.9
Kiteworks Core Insufficient Verification of Data Authenticity
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be …
-
Medium 6.7
Kiteworks Core Privilege Escalation through External Control of File Name or Path
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend …
-
High 8.7
pypdf: Possible long runtimes with large amount of embedded files
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producin…
-
High 7.2
Kiteworks Core Remote Code Execution through Server-Side Template Injection
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operat…
-
High 7.5
Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution,…
-
High 8.7
Kiteworks Core stored XSS
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary Ja…
-
Medium 5.3
Kiteworks Email Protection Gateway Uncontrolled Resource Consumption
A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.
-
High 7.2
Kiteworks Secure Data Forms Missing Authentication for Critical Function
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to us…
-
Critical 9.4
Kiteworks Email Protection Gateway Improper Access Control
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account…
-
High 8.7
pypdf: Possible long runtimes when generating appearance streams
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application…
-
Critical 9.3
Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could h…
-
Medium 6.5
Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administ…
-
Medium 6.6
Kiteworks Core Server-Side Request Forgery through CRLF Injection
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
-
High 7.2
Kiteworks Email Protection Gateway remote code execution
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being proce…
-
High 7.2
Kiteworks Core OS command injection
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the und…
-
High 7.2
Kiteworks Core arbitrary file write
Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on…
-
Critical 9.1
Kiteworks Email Protection Gateway server-side request forgery
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fe…
-
High 7.2
Kiteworks Email Protection Gateway unsafe reflection
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-r…
-
High 7.2
Kiteworks Core improper privilege management
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to…
-
High 8.7
Kiteworks Core stored XSS
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content.…
-
High 8.7
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery c…
-
High 7.5
Kiteworks Secure Data Forms server-side request forgery
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially…