CVE-database
132.662 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-102123 HIGH · 7.4 A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a… Accellion
- CVE-2026-102122 MEDIUM · 4.3 Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager… Accellion
- CVE-2026-102121 HIGH · 8.6 A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned… Accellion
- CVE-2026-102120 HIGH · 8.8 A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment… Accellion
- CVE-2026-102119 HIGH · 7.2 A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory.… Accellion
- CVE-2026-102118 HIGH · 7.8 A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root… Accellion
- CVE-2026-102117 HIGH · 7.2 On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect… Accellion
- CVE-2026-102116 HIGH · 7.2 -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to… Accellion
- CVE-2026-102115 CRITICAL · 9.8 Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user… Accellion
- CVE-2026-102114 HIGH · 7.2 A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful… Accellion
- CVE-2026-102113 HIGH · 7.8 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance… Accellion
- CVE-2026-102112 HIGH · 7.8 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance… Accellion
- CVE-2026-102111 MEDIUM · 4.9 Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so… Accellion
- CVE-2026-102110 MEDIUM · 5.9 An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation… Accellion
- CVE-2026-102109 HIGH · 7.1 A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a… Accellion
- CVE-2026-102108 HIGH · 7.2 An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation,… Accellion
- CVE-2026-102107 MEDIUM · 4.6 Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from… Accellion
- CVE-2026-102106 CRITICAL · 9.1 Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so… Accellion
- CVE-2026-102105 CRITICAL · 9.1 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway… Accellion
- CVE-2026-102104 CRITICAL · 9.1 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway… Accellion
- CVE-2026-102103 CRITICAL · 9.1 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway… Accellion
- CVE-2026-102102 CRITICAL · 9.1 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway… Accellion
- CVE-2026-102101 HIGH · 8.1 Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data… Accellion
- CVE-2026-102100 HIGH · 8.7 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user… Accellion
- CVE-2026-102099 HIGH · 7.2 Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature… Accellion
- CVE-2026-102098 HIGH · 7.2 Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated… Accellion
- CVE-2026-102097 HIGH · 7.2 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose… Accellion
- CVE-2026-102096 HIGH · 7.2 Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not… Accellion
- CVE-2026-102095 CRITICAL · 9.1 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the… Accellion
- CVE-2026-102094 HIGH · 7.2 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load… Accellion
- CVE-2026-102093 HIGH · 7.2 Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated… Accellion
- CVE-2026-102092 HIGH · 8.7 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary… Accellion
- CVE-2026-102091 HIGH · 7.5 Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue… Accellion
- CVE-2026-102090 MEDIUM · 4.3 Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to… Accellion
- CVE-2026-102089 HIGH · 7.2 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write… Accellion
- CVE-2026-101276 NONE iperf3 3.21 (esnet/iperf) bevat een externe, niet-geverifieerde heap use-after-free: de per-test watchdog server_timer_proc() van de server maakt streams vrij zonder hun werkthreads te annuleren/aan te…
- CVE-2024-58387 HIGH · 7.5 Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying…
- CVE-2023-54403 HIGH · 7.5 Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1…
- CVE-2023-54402 HIGH · 7.5 iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default…
- CVE-2026-103548 NONE Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to…
- CVE-2026-103547 NONE In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process…
- CVE-2026-103387 MEDIUM · 4.3 A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header…
- CVE-2026-102994 HIGH · 7.5 pypdf is een gratis en open-source pure-python PDF-bibliotheek. Voorafgaand aan 6.18.0 kan een vervaardigde PDF met indirecte object-ID's of tokens met een generatienummer die lange… Pypdf Project
- CVE-2026-102993 HIGH · 7.5 pypdf is een gratis en open-source pure-python PDF-bibliotheek. Voorafgaand aan 6.17.0 kan een vervaardigde PDF ongebruikelijk grote Romeinse paginalabelwaarden bieden die ervoor zorgen dat pypdf/_page_labels.py… Pypdf Project
- CVE-2026-102992 NONE piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from…
- CVE-2026-102991 MEDIUM · 6.5 Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py…
- CVE-2026-102990 NONE basic-ftp is een FTP-client voor Node.js. Voorafgaand aan 6.2.1 kan Client.list () door een kwaadwillende of gecompromitteerde FTP-server worden gedwongen om kwadratische CPU-tijd te besteden…
- CVE-2026-101885 HIGH · 7.8 ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers…
- CVE-2026-101884 HIGH · 7.5 OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or…
- CVE-2026-101883 MEDIUM · 5.4 OpenClaw Windows Node tot en met 2026.9.4 bevat een kwetsbaarheid voor server-side request forgery in het canvas.present-mogelijkheid die URL-risico-evaluatie omzeilt die wordt afgedwongen door canvas.navigate.…