# Kiteworks Core.

Every CVE that names Kiteworks Core among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Kiteworks Core user impersonation in a file-request feature](https://agentprime.io/advisories/CVE-2026-102107.md)
  `CVE-2026-102107` · CVE record: Kiteworks Core · CVSS 4.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authentication on a Kiteworks appliance setup function](https://agentprime.io/advisories/CVE-2026-102110.md)
  `CVE-2026-102110` · CVE record: Kiteworks Core · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, CWE-670
- [Kiteworks Core Improper Validation of Specified Quantity in Input](https://agentprime.io/advisories/CVE-2026-102111.md)
  `CVE-2026-102111` · CVE record: Kiteworks Core · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1284
- [Kiteworks Core Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102112.md)
  `CVE-2026-102112` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Privilege escalation
- [Kiteworks Core Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102113.md)
  `CVE-2026-102113` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core OS Command Injection](https://agentprime.io/advisories/CVE-2026-102114.md)
  `CVE-2026-102114` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Kiteworks Core Authentication Bypass in the Password Reset Workflow](https://agentprime.io/advisories/CVE-2026-102115.md)
  `CVE-2026-102115` · CVE record: Kiteworks Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-640
- [Kiteworks Core Remote Code Execution](https://agentprime.io/advisories/CVE-2026-102117.md)
  `CVE-2026-102117` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-807, CWE-940
- [Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-102118.md)
  `CVE-2026-102118` · CVE record: Kiteworks Core · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core OS Command Injection](https://agentprime.io/advisories/CVE-2026-102120.md)
  `CVE-2026-102120` · CVE record: Kiteworks Core · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Privilege escalation
- [Kiteworks Core Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-102122.md)
  `CVE-2026-102122` · CVE record: Kiteworks Core · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Kiteworks Core Path Traversal](https://agentprime.io/advisories/CVE-2026-102123.md)
  `CVE-2026-102123` · CVE record: Kiteworks Core · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Core Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-102124.md)
  `CVE-2026-102124` · CVE record: Kiteworks Core · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, CWE-670
- [Kiteworks Core Sandbox Escape](https://agentprime.io/advisories/CVE-2026-102125.md)
  `CVE-2026-102125` · CVE record: Kiteworks Core · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, CWE-653
- [Kiteworks Core Stored Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2026-102126.md)
  `CVE-2026-102126` · CVE record: Kiteworks Core · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kiteworks Core Incorrect Privilege Assignment](https://agentprime.io/advisories/CVE-2026-102129.md)
  `CVE-2026-102129` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Kiteworks Core Privilege Escalation through Improper Access Control](https://agentprime.io/advisories/CVE-2026-102132.md)
  `CVE-2026-102132` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Kiteworks Core Arbitrary File Write through Command Injection](https://agentprime.io/advisories/CVE-2026-102133.md)
  `CVE-2026-102133` · CVE record: Kiteworks Core · CVSS 6.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Kiteworks Core Unprotected Alternate Channel](https://agentprime.io/advisories/CVE-2026-102134.md)
  `CVE-2026-102134` · CVE record: Kiteworks Core · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-420
- [Kiteworks Core Command Execution through Configuration Injection](https://agentprime.io/advisories/CVE-2026-102136.md)
  `CVE-2026-102136` · CVE record: Kiteworks Core · CVSS 6.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection
- [Kiteworks Core Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-102137.md)
  `CVE-2026-102137` · CVE record: Kiteworks Core · CVSS 4.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [Kiteworks Core Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-102138.md)
  `CVE-2026-102138` · CVE record: Kiteworks Core · CVSS 3.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Kiteworks Core deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-102101.md)
  `CVE-2026-102101` · CVE record: Kiteworks Core · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization
- [Kiteworks Core Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/CVE-2026-102140.md)
  `CVE-2026-102140` · CVE record: Kiteworks Core · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-345
- [Kiteworks Core Privilege Escalation through External Control of File Name or Path](https://agentprime.io/advisories/CVE-2026-102141.md)
  `CVE-2026-102141` · CVE record: Kiteworks Core · CVSS 6.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Privilege escalation
- [Kiteworks Core Remote Code Execution through Server-Side Template Injection](https://agentprime.io/advisories/CVE-2026-102142.md)
  `CVE-2026-102142` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Kiteworks Core stored XSS](https://agentprime.io/advisories/CVE-2026-102100.md)
  `CVE-2026-102100` · CVE record: Kiteworks Core · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2026-102147.md)
  `CVE-2026-102147` · CVE record: Kiteworks Core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kiteworks Core Server-Side Request Forgery through CRLF Injection](https://agentprime.io/advisories/CVE-2026-102145.md)
  `CVE-2026-102145` · CVE record: Kiteworks Core · CVSS 6.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection
- [Kiteworks Core OS command injection](https://agentprime.io/advisories/CVE-2026-102096.md)
  `CVE-2026-102096` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Kiteworks Core arbitrary file write](https://agentprime.io/advisories/CVE-2026-102099.md)
  `CVE-2026-102099` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [Kiteworks Core improper privilege management](https://agentprime.io/advisories/CVE-2026-102093.md)
  `CVE-2026-102093` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Kiteworks Core stored XSS](https://agentprime.io/advisories/CVE-2026-102092.md)
  `CVE-2026-102092` · CVE record: Kiteworks Core · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kiteworks Core content injection](https://agentprime.io/advisories/CVE-2026-102090.md)
  `CVE-2026-102090` · CVE record: Kiteworks Core · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Open redirect
- [Kiteworks Core SQL Injection](https://agentprime.io/advisories/CVE-2026-102098.md)
  `CVE-2026-102098` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management](https://agentprime.io/advisories/CVE-2026-23514.md)
  `CVE-2026-23514` · CVE record: kiteworks core · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-282

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=kiteworks-core>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/kiteworks-core/>. Everything for agents: <https://agentprime.io/llms.txt>.