Threat database

CVE-2026-102998 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by inefficient processing of appearance-stream generation when updating PDF form fields with flattening enabled. This can lead to excessive runtimes and potential application unavailability. The issue is fixed in pypdf version 6.19.0.

CVE-2026-102147 is a critical stored cross-site scripting (XSS) vulnerability in Kiteworks Core. An unauthenticated attacker can inject malicious content that executes arbitrary JavaScript in the session of an administrator viewing the affected page. This can lead to full administrative control, including creating new admin accounts. The vulnerability affects Kiteworks Core versions from 0 up to but not including 9.5.1. No patch information is provided in the available data.

CVE-2026-102146 is a vulnerability in Kiteworks Email Protection Gateway where an authenticated administrator with limited delegated permissions can write files with attacker-controlled content to arbitrary locations accessible by the service account. This privilege escalation can lead to modification of application files or configurations and potentially disrupt service availability. The vulnerability affects versions prior to 9.5.1. The CVSS score is 6.5, indicating a medium severity impact.

CVE-2026-102145 is a vulnerability in Kiteworks Core where an authenticated administrator can exploit improper neutralization of CRLF sequences (CRLF Injection). This flaw allows the server to issue requests to internal network services that should not be accessible through the interface. The vulnerability does not lead to code execution by itself.

Kiteworks Email Protection Gateway versions before 9.5.0 contain a vulnerability that allows an authenticated administrator to import configuration files without sufficient validation. This flaw can lead to remote code execution on the affected gateway by processing crafted submissions. The vulnerability is identified as CWE-22 (Path Traversal) and CWE-94 (Improper Control of Generation of Code).

Kiteworks Core versions prior to 9.5.0 contain an OS Command Injection vulnerability. This flaw allows an authenticated administrator to upload a specially crafted configuration package that is not properly validated. Exploiting this vulnerability could lead to arbitrary command execution on the underlying system with potentially elevated privileges.

Kiteworks Core versions prior to 9.5.0 contain a path traversal vulnerability (CWE-22) in an administrative export feature. This flaw allows an authenticated administrator to write files to arbitrary locations on the host system, which could lead to command execution on the appliance. Exploitation requires valid administrative credentials and access to the vulnerable export function.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

pypdf versions prior to 6.18.1 contain a vulnerability where a crafted PDF with a malformed /FlateDecode stream causes inefficient byte-by-byte decompression. This leads to excessive resource consumption, resulting in long runtimes and potential application unavailability. The issue is a residual problem after a previous fix related to malformed FlateDecode recovery. The vulnerability is fixed in version 6.18.1.

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

Kiteworks Core versions prior to 9.5.0 contain a stored SQL injection vulnerability in an administrative reporting feature. This flaw allows an authenticated administrator to read sensitive database information and potentially disrupt service availability. Exploitation requires valid administrative credentials and access to the vulnerable reporting function.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-102996 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by processing an unusually large /Widths array in a crafted PDF's simple font. This leads to excessive memory usage during operations like text extraction. The issue is fixed in pypdf version 6.18.1.

CVE-2026-102995 is a high-severity vulnerability in the py-pdf pypdf library prior to version 6.18.1. It involves uncontrolled resource consumption caused by crafted PDFs that place unusually large tokens in a font /ToUnicode mapping. This triggers excessive memory use during text extraction operations. The issue is fixed in version 6.18.1.

CVE-2026-102994 is a high-severity vulnerability in the pypdf library prior to version 6.18.0. It involves uncontrolled resource consumption caused by crafted PDFs containing long sequences of indirect-object identifiers or generation-number tokens without whitespace. This leads to excessive scanning in specific pypdf modules, resulting in long runtimes and potential application unavailability. The issue is resolved in pypdf version 6.18.0.

CVE-2026-102993 is a high-severity vulnerability in the pypdf Python library prior to version 6.17.0. It involves uncontrolled resource consumption caused by processing crafted PDF files with unusually large Roman page-label values. This leads to excessive memory use and potential application unavailability. The issue is fixed in pypdf version 6.17.0.