[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101148 | 1 Oct 2026 | CVSS 10.0 | Unknown BackupSheep WordPress Backup PluginThe BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key… | |
| CVE-2026-103540 | 1 Oct 2026 | CVSS 6.3 | formtools.org Form ToolsA security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function… | |
| CVE-2026-101147 | 1 Oct 2026 | CVSS 8.8 | Unknown Featured Image from URL (FIFU)The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not… | |
| CVE-2026-82829 | 1 Oct 2026 | CVSS 9.8 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized… | |
| CVE-2026-92548 | 1 Oct 2026 | CVSS 5.3 | hcabrera WP Popular PostsThe WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the… | |
| CVE-2026-92966 | 1 Oct 2026 | CVSS 9.1 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode… | |
| CVE-2026-78210 | 1 Oct 2026 | CVSS 7.1 | Octopus Deploy Octopus ServerIn affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without… | |
| CVE-2026-82824 | 1 Oct 2026 | CVSS 9.8 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or… | |
| CVE-2026-82825 | 1 Oct 2026 | CVSS 9.8 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated… | |
| CVE-2026-82826 | 1 Oct 2026 | CVSS 7.5 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to… | |
| CVE-2026-82827 | 1 Oct 2026 | CVSS 9.8 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key… | |
| CVE-2026-82828 | 1 Oct 2026 | CVSS 8.8 | Hitachi Industrial Equipment Systems Hitachi Coding Software SuiteHitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level… | |
| CVE-2026-76142 | 1 Oct 2026 | CVSS 9.3 | Genians, Inc Genian NAC 5.0.75 LTS ReleaseInsufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated… | |
| CVE-2026-76143 | 1 Oct 2026 | CVSS 7.3 | Genians, Inc Genian SSL PNS (frodo-core)A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request… | |
| CVE-2026-76144 | 1 Oct 2026 | CVSS 1.8 | Genians, Inc Genian SSL PNS (frodo-core)An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to… | |
| CVE-2026-76145 | 1 Oct 2026 | CVSS 7.5 | Genians, Inc Genian SSL PNS (frodo-core)An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the… | |
| CVE-2026-76146 | 1 Oct 2026 | CVSS 8.4 | Genians, Inc Genian SSL PNS (xenics_auther)An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute… | |
| CVE-2026-76147 | 1 Oct 2026 | CVSS 5.9 | Genians, Inc Genian NAC 4.0.175 ReleaseA path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian… | |
| CVE-2026-103538 | 1 Oct 2026 | CVSS 6.5 | ZongXR SuperMarketA security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file… | |
| CVE-2026-103539 | 1 Oct 2026 | CVSS 5.4 | ZongXR SuperMarketA weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file… | |
| CVE-2026-12241 | 1 Oct 2026 | CVSS 5.4 | mihail-barinov Advanced Woo Labels – Product Labels & Badges for WooCommerceThe Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an… | |
| CVE-2026-103536 | 1 Oct 2026 | CVSS 7.3 | ZongXR SupermarketA vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file… | |
| CVE-2026-96561 | 1 Oct 2026 | CVSS 7.2 | tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPressThe AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to… | |
| CVE-2026-91109 | 1 Oct 2026 | CVSS 6.5 | croixhaug Simply Schedule AppointmentsThe Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… | |
| CVE-2026-92245 | 1 Oct 2026 | CVSS 7.5 | croixhaug Simply Schedule AppointmentsThe Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32… | |
| CVE-2026-103534 | 1 Oct 2026 | CVSS 6.3 | David-Crty databasementA vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the… | |
| CVE-2026-103641 | 1 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width… | |
| CVE-2026-103533 | 1 Oct 2026 | CVSS 4.1 | David-Crty databasementA vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the… | |
| CVE-2026-92537 | 1 Oct 2026 | CVSS 5.3 | satollo Newsletter – Send awesome emails from WordPressThe Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to… | |
| CVE-2026-101887 | 1 Oct 2026 | CVSS 3.5 | arkq bluez-alsaBlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that… | |
| CVE-2026-93495 | 1 Oct 2026 | CVSS 7.0 | ASUS Motherboard(PRIME Z390-A )Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially… | |
| CVE-2026-103532 | 1 Oct 2026 | CVSS 5.3 | immich-app ImmichA vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file… | |
| CVE-2026-13313 | 1 Oct 2026 | CVSS 8.9 | ASUS RouterAn Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security… | |
| CVE-2026-14157 | 1 Oct 2026 | CVSS 9.4 | ASUS RouterUse of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a… | |
| CVE-2026-103531 | 1 Oct 2026 | CVSS 5.5 | OpenSCA flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-setcos.c… | |
| CVE-2026-103530 | 1 Oct 2026 | CVSS 7.3 | decolua 9RouterA vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of… | |
| CVE-2026-103587 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where… | |
| CVE-2026-103588 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form… | |
| CVE-2026-103589 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num… | |
| CVE-2026-103590 | 30 Sep 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers… | |
| CVE-2026-103591 | 30 Sep 2026 | CVSS 7.5 | AsyncFuncAI deepwiki-openDeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url… | |
| CVE-2026-103592 | 30 Sep 2026 | CVSS 6.5 | pecee simple-routersimple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote… | |
| CVE-2026-103584 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki CommonsMetadata extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata… | |
| CVE-2026-103585 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki MediaSearch extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch… | |
| CVE-2026-101283 | 30 Sep 2026 | CVSS 9.2 | esnet iperf3iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the… | |
| CVE-2026-103001 | 30 Sep 2026 | CVSS 6.5 | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusePyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a… | Fix |
| CVE-2026-47096 | 30 Sep 2026 | CVSS 6.1 | AJA Video Systems HELO PlusAJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to… | |
| CVE-2026-92172 | 30 Sep 2026 | CVSS 8.8 | Meta Platforms, Inc Meta Horizon OSPrior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon… | |
| CVE-2026-92173 | 30 Sep 2026 | CVSS 9.1 | Meta Platforms, Inc Meta Horizon OSPrior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell… | |
| CVE-2026-51872 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityDevika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. | |
| CVE-2026-51860 | 30 Sep 2026 | CVSS 7.5 | Vulnerabilitybisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. | |
| CVE-2026-51861 | 30 Sep 2026 | CVSS 9.8 | Vulnerabilitybisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. | |
| CVE-2026-51862 | 30 Sep 2026 | CVSS 9.1 | VulnerabilityDB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker… | |
| CVE-2026-51864 | 30 Sep 2026 | CVSS 9.1 | VulnerabilityDB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload… | |
| CVE-2026-51866 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityIn DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real… | |
| CVE-2026-51867 | 30 Sep 2026 | CVSS 9.8 | Vulnerabilityagentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a… | |
| CVE-2026-51869 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityDB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host. | |
| CVE-2026-51870 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityDeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute. | |
| CVE-2026-51871 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityDevika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve… | |
| CVE-2026-51570 | 30 Sep 2026 | CVSS 8.1 | Vulnerabilitymodelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file. | |
| CVE-2026-51852 | 30 Sep 2026 | CVSS 7.5 | Vulnerabilityagent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The… | |
| CVE-2026-51853 | 30 Sep 2026 | CVSS 7.5 | Vulnerabilityagent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class… | |
| CVE-2026-51856 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityIn agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can… | |
| CVE-2026-51857 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an… | |
| CVE-2026-51858 | 30 Sep 2026 | CVSS 9.8 | VulnerabilityIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval… | |
| CVE-2026-51859 | 30 Sep 2026 | CVSS 9.1 | Vulnerabilitybisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). | |
| CVE-2026-51568 | 30 Sep 2026 | CVSS 8.1 | Vulnerabilitymodelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file. | |
| CVE-2026-102997 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with… | Fix |
| CVE-2026-102998 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes when generating appearance streamspypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause… | Fix |
| CVE-2026-102999 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes with large amount of embedded filespypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based… | Fix |
| CVE-2026-103000 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when retrieving alphabetical page labelspypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values… | Fix |
| CVE-2026-102995 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string… | Fix |
| CVE-2026-102996 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when parsing font datapypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually… | Fix |
| CVE-2026-102142 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreA system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored… | |
| CVE-2026-102143 | 30 Sep 2026 | CVSS 7.5 | Kiteworks Email Protection GatewayAn unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative… | |
| CVE-2026-102144 | 30 Sep 2026 | CVSS 5.3 | Kiteworks Email Protection GatewayA resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a… | |
| CVE-2026-102145 | 30 Sep 2026 | CVSS 6.6 | Kiteworks CoreAn authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be… | |
| CVE-2026-102146 | 30 Sep 2026 | CVSS 6.5 | Kiteworks Email Protection GatewayAn authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled… | |
| CVE-2026-102147 | 30 Sep 2026 | CVSS 9.3 | Kiteworks CoreA stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes… | |
| CVE-2026-102149 | 30 Sep 2026 | CVSS 9.4 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to… | |
| CVE-2026-102150 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Secure Data FormsA function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to… | |
| CVE-2026-102134 | 30 Sep 2026 | CVSS 5.4 | Kiteworks CoreKiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication… | |
| CVE-2026-102135 | 30 Sep 2026 | CVSS 6.6 | Kiteworks Email Protection GatewayOn a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized… | |
| CVE-2026-102136 | 30 Sep 2026 | CVSS 6.3 | Kiteworks CoreIn multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster… | |
| CVE-2026-102137 | 30 Sep 2026 | CVSS 4.1 | Kiteworks CoreAn authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous… | |
| CVE-2026-102138 | 30 Sep 2026 | CVSS 3.3 | Kiteworks CoreAn authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server… | |
| CVE-2026-102139 | 30 Sep 2026 | CVSS 6.5 | Kiteworks Email Protection GatewayAn authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user… | |
| CVE-2026-102140 | 30 Sep 2026 | CVSS 4.9 | Kiteworks CoreAn authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import… | |
| CVE-2026-102141 | 30 Sep 2026 | CVSS 6.7 | Kiteworks CoreTwo Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster… | |
| CVE-2026-102127 | 30 Sep 2026 | CVSS 7.0 | Kiteworks Email Protection GatewayAn XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default… | |
| CVE-2026-102128 | 30 Sep 2026 | CVSS 7.5 | Kiteworks Email Protection GatewayAn identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it… | |
| CVE-2026-102129 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreA user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An… | |
| CVE-2026-102130 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the… | |
| CVE-2026-102131 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be… | |
| CVE-2026-102132 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreAn administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged… | |
| CVE-2026-102133 | 30 Sep 2026 | CVSS 6.6 | Kiteworks CoreAn optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before… | |
| CVE-2026-102120 | 30 Sep 2026 | CVSS 8.8 | Kiteworks CoreA privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered… | |
| CVE-2026-102121 | 30 Sep 2026 | CVSS 8.6 | Kiteworks Secure Data FormsA form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous… | |
| CVE-2026-102122 | 30 Sep 2026 | CVSS 4.3 | Kiteworks CoreKiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user… | |
| CVE-2026-102123 | 30 Sep 2026 | CVSS 7.4 | Kiteworks CoreA Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated… |
Page 131 of 168