Security Advisories
Approved changes feed: RSS · Atom
cpe:2.3:a:kiteworks:security-advisories:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kiteworks (d7914f90-f1d3-5b1c-b860-b41dc97d8156) |
|---|---|
| Product | Security Advisories (5c066f22-b7d1-50dd-8880-be1c88cbb9fb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28272 |
vulnerable | 2026-06-08 07:55:15.127029 |
Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability
HIGH (8.1)
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
Published: 2026-02-27T20:22:59.656Z
Updated: 2026-03-03T20:27:59.264Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28271 |
vulnerable | 2026-06-08 07:55:15.126618 |
Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
MEDIUM (6.5)
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
Published: 2026-02-27T20:21:12.194Z
Updated: 2026-03-03T20:27:38.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28270 |
vulnerable | 2026-06-08 07:55:15.126199 |
Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
MEDIUM (4.9)
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.
Published: 2026-02-27T20:19:54.611Z
Updated: 2026-03-03T20:27:18.932Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28269 |
vulnerable | 2026-06-08 07:55:15.125032 |
Kiteworks Core has an OS Command Injection
MEDIUM (5.9)
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
Published: 2026-02-26T22:52:26.688Z
Updated: 2026-02-27T17:53:05.993Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24754 |
vulnerable | 2026-06-08 07:51:18.124778 |
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
MEDIUM (5.4)
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Published: 2026-06-01T21:46:56.301Z
Updated: 2026-06-02T15:45:48.778Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53939 |
vulnerable | 2026-06-08 07:31:15.958996 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53900 |
vulnerable | 2026-06-08 07:31:15.919462 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53899 |
vulnerable | 2026-06-08 07:31:15.919029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53897 |
vulnerable | 2026-06-08 07:31:15.918757 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53896 |
vulnerable | 2026-06-08 07:31:15.917469 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.