https://vulnogram.org/ Most recent CVEs assigned by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government (cisa-cg). https://vulnogram.org/seaview/icons/cisa-cg.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-105773 https://vulnogram.org/CVE-2026-105773 Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with syst… High Mon, 05 Oct 2026 20:38:55 GMT https://vulnogram.org/CVE-2026-102262 https://vulnogram.org/CVE-2026-102262 Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when… High Mon, 05 Oct 2026 20:37:26 GMT https://vulnogram.org/CVE-2026-101893 https://vulnogram.org/CVE-2026-101893 Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share ca… Medium Mon, 05 Oct 2026 20:36:21 GMT https://vulnogram.org/CVE-2026-102628 https://vulnogram.org/CVE-2026-102628 The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causi… Critical Network Exploitable Cloud Hosted Thu, 01 Oct 2026 19:44:40 GMT https://vulnogram.org/CVE-2026-100251 https://vulnogram.org/CVE-2026-100251 Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP… Medium Network Exploitable Cloud Hosted Thu, 01 Oct 2026 19:44:16 GMT https://vulnogram.org/CVE-2026-102671 https://vulnogram.org/CVE-2026-102671 The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default. Medium Network Exploitable Thu, 01 Oct 2026 19:43:44 GMT https://vulnogram.org/CVE-2026-102670 https://vulnogram.org/CVE-2026-102670 Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it. Medium Thu, 01 Oct 2026 19:43:27 GMT https://vulnogram.org/CVE-2026-102669 https://vulnogram.org/CVE-2026-102669 Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages. Medium Network Exploitable Thu, 01 Oct 2026 19:43:07 GMT https://vulnogram.org/CVE-2026-102668 https://vulnogram.org/CVE-2026-102668 The Joyland AI app accepts any TLS certificates from any server without validation. Medium Network Exploitable Thu, 01 Oct 2026 19:42:45 GMT https://vulnogram.org/CVE-2026-102667 https://vulnogram.org/CVE-2026-102667 Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or… Critical Thu, 01 Oct 2026 19:42:24 GMT https://vulnogram.org/CVE-2026-82358 https://vulnogram.org/CVE-2026-82358 RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated at… High Thu, 01 Oct 2026 19:42:16 GMT https://vulnogram.org/CVE-2026-102666 https://vulnogram.org/CVE-2026-102666 The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the ap… Medium Network Exploitable Thu, 01 Oct 2026 19:41:54 GMT https://vulnogram.org/CVE-2026-82357 https://vulnogram.org/CVE-2026-82357 RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker w… High Thu, 01 Oct 2026 19:41:47 GMT https://vulnogram.org/CVE-2026-102105 https://vulnogram.org/CVE-2026-102105 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce… Critical Network Exploitable Wed, 30 Sep 2026 20:25:02 GMT https://vulnogram.org/CVE-2026-102106 https://vulnogram.org/CVE-2026-102106 Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be… Critical Network Exploitable Wed, 30 Sep 2026 20:24:46 GMT https://vulnogram.org/CVE-2026-102107 https://vulnogram.org/CVE-2026-102107 Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act… Medium Wed, 30 Sep 2026 20:24:29 GMT https://vulnogram.org/CVE-2026-102108 https://vulnogram.org/CVE-2026-102108 An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the… High Wed, 30 Sep 2026 20:24:07 GMT https://vulnogram.org/CVE-2026-102109 https://vulnogram.org/CVE-2026-102109 A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially… High Wed, 30 Sep 2026 20:23:36 GMT https://vulnogram.org/CVE-2026-102110 https://vulnogram.org/CVE-2026-102110 An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the… Medium Network Exploitable Wed, 30 Sep 2026 20:21:42 GMT https://vulnogram.org/CVE-2026-102111 https://vulnogram.org/CVE-2026-102111 Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continu… Medium Wed, 30 Sep 2026 20:21:15 GMT https://vulnogram.org/CVE-2026-102112 https://vulnogram.org/CVE-2026-102112 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges.… High Wed, 30 Sep 2026 20:20:59 GMT https://vulnogram.org/CVE-2026-102113 https://vulnogram.org/CVE-2026-102113 A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem… High Wed, 30 Sep 2026 20:20:35 GMT https://vulnogram.org/CVE-2026-102114 https://vulnogram.org/CVE-2026-102114 A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account… High Wed, 30 Sep 2026 20:20:18 GMT https://vulnogram.org/CVE-2026-102115 https://vulnogram.org/CVE-2026-102115 Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without ac… Critical Network Exploitable Wed, 30 Sep 2026 20:19:55 GMT https://vulnogram.org/CVE-2026-102116 https://vulnogram.org/CVE-2026-102116 -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying s… High Wed, 30 Sep 2026 20:19:20 GMT https://vulnogram.org/CVE-2026-102117 https://vulnogram.org/CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destina… High Wed, 30 Sep 2026 20:19:02 GMT https://vulnogram.org/CVE-2026-102118 https://vulnogram.org/CVE-2026-102118 A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance. High Wed, 30 Sep 2026 20:18:21 GMT https://vulnogram.org/CVE-2026-102119 https://vulnogram.org/CVE-2026-102119 A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbit… High Wed, 30 Sep 2026 20:18:01 GMT https://vulnogram.org/CVE-2026-102120 https://vulnogram.org/CVE-2026-102120 A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the… High Wed, 30 Sep 2026 20:17:48 GMT https://vulnogram.org/CVE-2026-102121 https://vulnogram.org/CVE-2026-102121 A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of… High Network Exploitable Wed, 30 Sep 2026 20:17:31 GMT https://vulnogram.org/CVE-2026-102104 https://vulnogram.org/CVE-2026-102104 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce… Critical Network Exploitable Wed, 30 Sep 2026 20:17:17 GMT https://vulnogram.org/CVE-2026-102122 https://vulnogram.org/CVE-2026-102122 Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of… Medium Wed, 30 Sep 2026 20:16:24 GMT https://vulnogram.org/CVE-2026-102123 https://vulnogram.org/CVE-2026-102123 A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromisin… High Network Exploitable Wed, 30 Sep 2026 20:16:01 GMT https://vulnogram.org/CVE-2026-102103 https://vulnogram.org/CVE-2026-102103 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce… Critical Network Exploitable Wed, 30 Sep 2026 20:16:00 GMT https://vulnogram.org/CVE-2026-102124 https://vulnogram.org/CVE-2026-102124 A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, includ… Medium Network Exploitable Wed, 30 Sep 2026 20:15:38 GMT https://vulnogram.org/CVE-2026-102125 https://vulnogram.org/CVE-2026-102125 The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service ac… High Wed, 30 Sep 2026 20:15:25 GMT https://vulnogram.org/CVE-2026-102126 https://vulnogram.org/CVE-2026-102126 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of… High Wed, 30 Sep 2026 20:15:09 GMT https://vulnogram.org/CVE-2026-102127 https://vulnogram.org/CVE-2026-102127 An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to… High Network Exploitable Wed, 30 Sep 2026 20:14:56 GMT https://vulnogram.org/CVE-2026-102128 https://vulnogram.org/CVE-2026-102128 An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A… High Network Exploitable Wed, 30 Sep 2026 20:14:40 GMT https://vulnogram.org/CVE-2026-102129 https://vulnogram.org/CVE-2026-102129 A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account t… High Wed, 30 Sep 2026 20:14:13 GMT https://vulnogram.org/CVE-2026-102130 https://vulnogram.org/CVE-2026-102130 Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrar… High Wed, 30 Sep 2026 20:13:58 GMT https://vulnogram.org/CVE-2026-102131 https://vulnogram.org/CVE-2026-102131 Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of t… High Wed, 30 Sep 2026 20:13:43 GMT https://vulnogram.org/CVE-2026-102132 https://vulnogram.org/CVE-2026-102132 An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrativ… High Wed, 30 Sep 2026 20:13:28 GMT https://vulnogram.org/CVE-2026-102133 https://vulnogram.org/CVE-2026-102133 An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional comm… Medium Wed, 30 Sep 2026 20:13:09 GMT https://vulnogram.org/CVE-2026-102102 https://vulnogram.org/CVE-2026-102102 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce… Critical Network Exploitable Wed, 30 Sep 2026 20:12:42 GMT https://vulnogram.org/CVE-2026-102134 https://vulnogram.org/CVE-2026-102134 Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those con… Medium Wed, 30 Sep 2026 20:12:39 GMT https://vulnogram.org/CVE-2026-102135 https://vulnogram.org/CVE-2026-102135 On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the… Medium Wed, 30 Sep 2026 20:12:22 GMT https://vulnogram.org/CVE-2026-102136 https://vulnogram.org/CVE-2026-102136 In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validati… Medium Wed, 30 Sep 2026 20:12:07 GMT https://vulnogram.org/CVE-2026-102137 https://vulnogram.org/CVE-2026-102137 An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separat… Medium Wed, 30 Sep 2026 20:11:52 GMT https://vulnogram.org/CVE-2026-102138 https://vulnogram.org/CVE-2026-102138 An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue request… Low Wed, 30 Sep 2026 20:11:32 GMT