CVE-2026-102132 is a high-severity vulnerability in Kiteworks Core where an administrative import function fails to verify if a delegated administrator is authorized to create privileged integration credentials. This flaw allows a delegated administrator with limited permissions to escalate privileges to full system administrator without intervention from an existing system administrator. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102133 is a command injection vulnerability in the Kiteworks Core product affecting an optional repository-connector feature. This flaw allows an authenticated system administrator to inject commands via a user-supplied path that is not properly neutralized before being passed to an external command. Successful exploitation could lead to arbitrary code execution under the service account running the connector, requiring network egress to an attacker-controlled system. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-103000 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by unusually large alphabetical page-label values in crafted PDFs. This leads to excessive memory use and can potentially make applications using pypdf unavailable. The issue is fixed in version 6.19.0.
Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when processing inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of the gateway's operation. The vulnerability has a high severity with a CVSS score of 9.1.
CVE-2026-102134 is a medium severity vulnerability in Kiteworks Core where gateway-level API security controls were not applied to all requests authenticated via the central authentication service. This allowed authenticated users to access REST API functionality through alternate request paths that bypassed controls such as enforcement of signed-out and revoked sessions.
CVE-2026-102135 is a deserialization vulnerability in Kiteworks Email Protection Gateway when database replication is enabled. A trusted cluster peer can submit a crafted serialized object that is deserialized without sufficient validation, potentially leading to code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access. The vulnerability affects versions prior to 9.5.1.
CVE-2026-102136 is a vulnerability in Kiteworks Core affecting multi-node deployments. An attacker with code execution on one node can submit crafted input via an internal cluster interface, which is insufficiently validated when written into monitoring configuration on another node. This can lead to execution of OS commands under an unprivileged service account on the second node. The vulnerability is classified as a CRLF injection (CWE-93) and impacts versions prior to 9.5.1. The CVSS score is 6.3, indicating a medium severity.
CVE-2026-102137 is a vulnerability in Kiteworks Core that allows an authenticated administrator to bypass content validation during administrative file uploads, enabling storage of files with dangerous content on the appliance. This vulnerability alone does not lead to code execution, as exploiting that would require another separate vulnerability.
CVE-2026-102138 is a server-side request forgery (SSRF) vulnerability in Kiteworks Core. It affects versions prior to 9.5.1 and requires an authenticated administrator on a node with the licensed gateway role enabled. The vulnerability allows the administrator to supply a connector URL that the server retrieves without sufficient validation, potentially causing requests to internal network services. The CVSS score is low (3.3), reflecting limited impact and high attack complexity.
Kiteworks Core versions before 9.5.0 contain a deserialization vulnerability (CWE-502) that could allow remote code execution if an attacker can influence the deserialized data. Exploitation requires the attacker to control the input data, so the vulnerability is not exploitable on its own. The issue is rated high severity with a CVSS score of 8.1.
CVE-2026-102139 is an authorization bypass vulnerability in the large file exchange feature of Kiteworks Email Protection Gateway. It allows an authenticated user to access the subject, message body, and attachments of email packages they neither sent nor received. This occurs because the system does not properly verify that the requesting user is a party to the requested package.
CVE-2026-102140 is a vulnerability in Kiteworks Core where an authenticated administrator can import files without full verification of their contents. The import process only validates the file header, allowing unverified or forged content to be processed. This flaw affects data integrity but does not impact confidentiality or availability. The vulnerability affects Kiteworks Core versions prior to 9.5.1. The CVSS score is 4.9, indicating a medium severity level.
CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102999 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by the dictionary-based attachments API reparsing the full attachment list repeatedly when processing crafted PDFs with many embedded files. This leads to excessive CPU usage and long runtimes during embedded-file mapping access. The issue is fixed in pypdf version 6.19.0.
CVE-2026-102142 is a high-severity vulnerability in the Kiteworks Core appliance where a system notification template is processed by a template engine that evaluates expressions within the template body. An authenticated System Administrator can craft a malicious template that, when the notification is sent, executes operating system commands on the appliance. This vulnerability affects Kiteworks Core versions from initial up to but not including 9.5.1.
CVE-2026-102143 is a vulnerability in Kiteworks Email Protection Gateway where an unauthenticated attacker can write a file with attacker-controlled content to the appliance filesystem via an administrative upload handler lacking proper authentication. This flaw does not directly allow code execution, as that would require an additional vulnerability to place the file in an executable location. The issue affects versions prior to 9.5.1.
Kiteworks Core versions prior to 9.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to submit malicious content that executes arbitrary JavaScript in the context of another user's authenticated session when viewed. Such exploitation could enable actions on behalf of the victim, including potential account takeover of users with elevated privileges. Exploitation requires the victim to view the malicious content. The vulnerability has a high severity rating with a CVSS score of 8.7.
CVE-2026-102144 is a resource exhaustion vulnerability in Kiteworks Email Protection Gateway that allows an unauthenticated remote attacker to repeatedly trigger an expensive server-side operation, causing a partial denial of service. The vulnerability is due to missing authentication for a critical function. It affects versions from 0 up to but not including 9.5.1. The CVSS score is 5.3 (medium severity). No known exploits are reported in the wild and no patch information is provided.
CVE-2026-102150 is a vulnerability in Kiteworks Secure Data Forms where a critical function in the Advanced Forms component is accessible without authentication. This allows an unauthenticated attacker to perform a limited set of internal service operations on the platform. However, the vulnerability does not allow access to user accounts, stored files, or form submissions. The affected versions are from 9.3.0 up to but not including 9.5.1. The vulnerability has a CVSS score of 7.2, indicating high severity.
CVE-2026-102149 is a critical vulnerability in Kiteworks Email Protection Gateway where the system does not properly restrict certificate assignment to user accounts. This flaw allows an attacker to associate a certificate with another user's account, potentially compromising the confidentiality and integrity of encrypted emails. If certificate-based login is enabled, unauthorized access to the affected account may also be possible.