All CVEs — page 372 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 7.1CVE-2026-102109public exploit available2026-09-30
• HIGH 7.2CVE-2026-102108public exploit available2026-09-30
• MEDIUM 4.6CVE-2026-102107public exploit available2026-09-30
• CRITICAL 9.1CVE-2026-102106public exploit available2026-09-30

  The flaw allows an attacker to bypass authentication in the Kiteworks Email Protection Gateway administrative service, enabling them to modify or delete internal users and domains, and change security configurations without proper authorization.

• CRITICAL 9.1CVE-2026-102105public exploit available2026-09-30

  The flaw allows a remote, unauthenticated attacker to induce the Kiteworks Email Protection Gateway to issue requests to unintended internal network destinations, potentially disclosing sensitive information or triggering unintended actions.

• CRITICAL 9.1CVE-2026-102104public exploit available2026-09-30

  The flaw allows a remote, unauthenticated attacker to induce the gateway to make requests to internal network destinations, potentially disclosing sensitive information or disrupting operations.

• CRITICAL 9.1CVE-2026-102103public exploit available2026-09-30

  The flaw allows a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal network destinations, potentially disclosing sensitive information or disrupting gateway operation.

• CRITICAL 9.1CVE-2026-102102public exploit available2026-09-30

  The flaw allows a remote, unauthenticated attacker to induce the gateway to issue requests to internal network destinations, potentially disclosing sensitive information or disrupting the gateway operation.

• HIGH 8.1CVE-2026-102101public exploit available2026-09-30

  The flaw is a deserialization vulnerability in Kiteworks Core before version 9.5.0, which could allow remote code execution if an attacker can influence the data being deserialized.

• HIGH 8.7CVE-2026-102100public exploit available2026-09-30

  The flaw allows an authenticated user to inject malicious JavaScript, enabling account takeover. This is significant because it can lead to unauthorized actions and potentially full account compromise.

• HIGH 7.2CVE-2026-102099public exploit available2026-09-30
• HIGH 7.2CVE-2026-102098public exploit available2026-09-30
• HIGH 7.2CVE-2026-102097public exploit available2026-09-30
• HIGH 7.2CVE-2026-102096public exploit available2026-09-30
• CRITICAL 9.1CVE-2026-102095public exploit available2026-09-30

  The flaw allows a remote, unauthenticated attacker to forge server-side requests, potentially disclosing sensitive internal data or affecting internal services.

• HIGH 7.2CVE-2026-102094public exploit available2026-09-30
• HIGH 7.2CVE-2026-102093public exploit available2026-09-30
• HIGH 8.7CVE-2026-102092public exploit available2026-09-30

  The flaw allows an authenticated user to inject malicious JavaScript, leading to potential session hijacking and account takeover.

• HIGH 7.5CVE-2026-102091public exploit available2026-09-30

  The vulnerability allows unauthenticated attackers to make the server make arbitrary outbound network requests, potentially accessing internal services or network-restricted resources. This is a Server-Side Request Forgery (SSRF) flaw that could lead to information disclosure or further exploitation.

• MEDIUM 4.3CVE-2026-102090public exploit available2026-09-30
• HIGH 7.2CVE-2026-102089public exploit available2026-09-30
• UNSCOREDCVE-2026-1012762026-09-30
• HIGH 7.5CVE-2024-58387public exploit available2026-09-30

  The Inspur Haiyue HCM Cloud system has an arbitrary file read vulnerability in its model report file download endpoint, allowing attackers to read any file on the server's filesystem without authentication. This flaw enables disclosure of sensitive system files, database contents, and configuration data.

• HIGH 7.5CVE-2023-54403public exploit available2026-09-30

  The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the filePath parameter in /ajax/getemaildata.php, potentially exposing sensitive configuration files with database credentials and service details.

• HIGH 7.5CVE-2023-54402public exploit available2026-09-30

  The iDocView application has a server-side request forgery vulnerability in its document upload endpoint that allows unauthenticated attackers to fetch arbitrary URLs and read local files or access internal services. This flaw enables attackers to bypass authentication using a hardcoded token and exploit unrestricted URL schemes including file:// URIs.