Export limit exceeded: 403285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (403285 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105260 | 2026-10-08 | 4.3 Medium | ||
| The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page. | ||||
| CVE-2026-102131 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account. | ||||
| CVE-2026-102130 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account. | ||||
| CVE-2026-102129 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-08 | 7.2 High |
| A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges. | ||||
| CVE-2026-102128 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.5 High |
| An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account. | ||||
| CVE-2026-102127 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7 High |
| An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control. | ||||
| CVE-2026-102125 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-08 | 8.8 High |
| The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance. | ||||
| CVE-2026-102124 | 2 Accellion, Kiteworks | 2 Kiteworks, Core | 2026-10-08 | 6.5 Medium |
| A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration. | ||||
| CVE-2026-102121 | 2 Accellion, Kiteworks | 2 Kiteworks, Secure Data Forms | 2026-10-08 | 8.6 High |
| A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed. | ||||
| CVE-2026-102116 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account. | ||||
| CVE-2026-102109 | 2 Accellion, Kiteworks | 2 Kiteworks, Secure Data Forms | 2026-10-08 | 7.1 High |
| A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use. | ||||
| CVE-2026-102108 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege. | ||||
| CVE-2026-102106 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway. | ||||
| CVE-2026-102105 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems. | ||||
| CVE-2026-102104 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs an online certificate status check for an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation. | ||||
| CVE-2026-102103 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves a certificate revocation list in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation. | ||||
| CVE-2026-102102 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves an issuer certificate in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation. | ||||
| CVE-2026-102097 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway. | ||||
| CVE-2026-102095 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 9.1 Critical |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state. | ||||
| CVE-2026-102094 | 2 Accellion, Kiteworks | 2 Kiteworks, Kiteworks Email Protection Gateway | 2026-10-08 | 7.2 High |
| Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account. | ||||