Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 41–60 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 01 Oct 2026, 03:15 WIB

CVE-2026-102125

Kiteworks Core Sandbox Escape

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:15:25.475Z. Updated 2026-10-01T13:37:04.940Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:15 WIB

CVE-2026-102126

Kiteworks Core Stored Cross-site Scripting (XSS)

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 41 to 60 of 14934.First page Next page

Published 2026-09-30T20:15:09.284Z. Updated 2026-10-01T13:37:05.091Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:14 WIB

CVE-2026-102127

Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including crypt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:14:56.156Z. Updated 2026-10-01T13:37:05.291Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:14 WIB

CVE-2026-102128

Kiteworks Email Protection Gateway Improper Authentication

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:14:40.084Z. Updated 2026-10-01T13:37:05.460Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:14 WIB

CVE-2026-102129

Kiteworks Core Incorrect Privilege Assignment

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:14:13.681Z. Updated 2026-10-01T13:37:05.610Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:13 WIB

CVE-2026-102130

Kiteworks Email Protection Gateway Remote Code Execution

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:13:58.897Z. Updated 2026-10-01T13:37:05.756Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:13 WIB

CVE-2026-102131

Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:13:43.236Z. Updated 2026-10-01T13:37:05.899Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:13 WIB

CVE-2026-102132

Kiteworks Core Privilege Escalation through Improper Access Control

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:13:28.434Z. Updated 2026-10-01T13:37:06.034Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:13 WIB

CVE-2026-102133

Kiteworks Core Arbitrary File Write through Command Injection

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:13:09.677Z. Updated 2026-10-01T13:37:06.177Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:13 WIB

CVE-2026-103000

pypdf: Possible large memory usage when retrieving alphabetical page labels

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:13:00.379Z. Updated 2026-09-30T20:49:21.058Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:49 WIB

Official record

CritPublished 01 Oct 2026, 03:12 WIB

CVE-2026-102102

Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise uninten…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:12:42.032Z. Updated 2026-10-01T13:37:06.475Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:12 WIB

CVE-2026-102134

Kiteworks Core Unprotected Alternate Channel

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:12:39.707Z. Updated 2026-10-01T13:37:06.623Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:12 WIB

CVE-2026-102135

Kiteworks Email Protection Gateway Deserialization of Untrusted Data

On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:12:22.410Z. Updated 2026-10-01T13:37:06.765Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:12 WIB

CVE-2026-102136

Kiteworks Core Command Execution through Configuration Injection

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:12:07.108Z. Updated 2026-10-01T13:37:06.915Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:11 WIB

CVE-2026-102137

Kiteworks Core Unrestricted Upload of File with Dangerous Type

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:11:52.485Z. Updated 2026-10-01T13:37:07.054Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

LowPublished 01 Oct 2026, 03:11 WIB

CVE-2026-102138

Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:11:32.172Z. Updated 2026-10-01T13:37:07.204Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

HighPublished 01 Oct 2026, 03:11 WIB

CVE-2026-102101

Kiteworks Core deserialization of untrusted data

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:11:24.441Z. Updated 2026-10-01T13:37:07.362Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:11 WIB

CVE-2026-102139

Kiteworks Email Protection Gateway Incorrect Authorization

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:11:17.678Z. Updated 2026-10-01T13:37:07.509Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:11 WIB

CVE-2026-102140

Kiteworks Core Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the import…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:11:07.754Z. Updated 2026-10-01T13:37:07.652Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated01 Oct 2026, 20:37 WIB

Official record

MedPublished 01 Oct 2026, 03:10 WIB

CVE-2026-102141

Kiteworks Core Privilege Escalation through External Control of File Name or Path

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:10:55.599Z. Updated 2026-10-07T15:52:15.930Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated07 Oct 2026, 22:52 WIB

Official record