GCVE - cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Accellion (`430c74a2-9aef-5e49-8a90-6fd4ceee7fe4`)
Product	Kiteworks (`5374c210-bd89-5adb-b2fc-50ab89ee027a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-29092`	vulnerable	2026-06-08 07:55:16.106226	Kiteworks Email Protection Gateway has an Insufficient Session Expiration MEDIUM (4.9) Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch. Published: 2026-03-25T16:59:55.033Z Updated: 2026-03-25T17:29:41.481Z Open on db.gcve.eu Reference links https://github.com/kiteworks/security-advisories/security/advisories/GHSA-92w7-fpjr-wpxc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-28272`	vulnerable	2026-06-08 07:55:15.127070	Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability HIGH (8.1) Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue. Published: 2026-02-27T20:22:59.656Z Updated: 2026-03-03T20:27:59.264Z Open on db.gcve.eu Reference links https://github.com/kiteworks/security-advisories/security/advisories/GHSA-7hxj-ch78-xqgr	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-28271`	vulnerable	2026-06-08 07:55:15.126664	Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF) MEDIUM (6.5) Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue. Published: 2026-02-27T20:21:12.194Z Updated: 2026-03-03T20:27:38.925Z Open on db.gcve.eu Reference links https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rmfx-6h9w-fq87	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-28270`	vulnerable	2026-06-08 07:55:15.126239	Kiteworks Core has an Unrestricted Upload of File with Dangerous Type MEDIUM (4.9) Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue. Published: 2026-02-27T20:19:54.611Z Updated: 2026-03-03T20:27:18.932Z Open on db.gcve.eu Reference links https://github.com/kiteworks/security-advisories/security/advisories/GHSA-v8x9-vwg6-cj45	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-28269`	vulnerable	2026-06-08 07:55:15.125869	Kiteworks Core has an OS Command Injection MEDIUM (5.9) Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch. Published: 2026-02-26T22:52:26.688Z Updated: 2026-02-27T17:53:05.993Z Open on db.gcve.eu Reference links https://github.com/kiteworks/security-advisories/security/advisories/GHSA-6j64-6fpp-9453	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24750`	vulnerable	2026-06-08 07:51:18.114859	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-23636`	vulnerable	2026-06-08 07:51:15.696912	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-23635`	vulnerable	2026-06-08 07:51:15.696177	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-53939`	vulnerable	2026-06-08 07:31:15.964041	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-31586`	vulnerable	2026-06-08 05:31:53.726751	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-31585`	vulnerable	2026-06-08 05:31:53.726344	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-9421`	vulnerable	2026-06-08 05:10:09.890230	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.