{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-26T14:57:02.836Z", "lastRun": "2026-10-26T14:31:46.188Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "kiteworks" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-102105", "url": "https://cveboard.org/i/cve-2026-102105", "urlPt": "https://cveboard.org/pt/i/cve-2026-102105", "json": "https://cveboard.org/i/cve-2026-102105.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hq47-4whq-9hgv", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-01T13:13:49.786Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102105" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00524, "percentile": 0.44188, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102105" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:25:02.880Z", "updatedAt": "2026-09-30T20:25:02.880Z" }, { "id": "cve-2026-102106", "url": "https://cveboard.org/i/cve-2026-102106", "urlPt": "https://cveboard.org/pt/i/cve-2026-102106", "json": "https://cveboard.org/i/cve-2026-102106.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-287", "name": "Improper Authentication" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-01T13:14:06.115Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102106" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.01071, "percentile": 0.64644, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102106" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:24:46.723Z", "updatedAt": "2026-09-30T20:24:46.723Z" }, { "id": "cve-2026-102115", "url": "https://cveboard.org/i/cve-2026-102115", "urlPt": "https://cveboard.org/pt/i/cve-2026-102115", "json": "https://cveboard.org/i/cve-2026-102115.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Core", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Core", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-01T13:27:29.042Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102115" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.01026, "percentile": 0.63372, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Core", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102115" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:19:55.265Z", "updatedAt": "2026-09-30T20:19:55.265Z" }, { "id": "cve-2026-102104", "url": "https://cveboard.org/i/cve-2026-102104", "urlPt": "https://cveboard.org/pt/i/cve-2026-102104", "json": "https://cveboard.org/i/cve-2026-102104.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mqw3-m87w-4fx4", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-01T13:21:53.782Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102104" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00715, "percentile": 0.53462, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102104" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:17:17.054Z", "updatedAt": "2026-09-30T20:17:17.054Z" }, { "id": "cve-2026-102103", "url": "https://cveboard.org/i/cve-2026-102103", "urlPt": "https://cveboard.org/pt/i/cve-2026-102103", "json": "https://cveboard.org/i/cve-2026-102103.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p435-6c3j-4gh5", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-01T13:22:45.904Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102103" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00715, "percentile": 0.53462, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102103" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:16:00.743Z", "updatedAt": "2026-09-30T20:16:00.743Z" }, { "id": "cve-2026-102102", "url": "https://cveboard.org/i/cve-2026-102102", "urlPt": "https://cveboard.org/pt/i/cve-2026-102102", "json": "https://cveboard.org/i/cve-2026-102102.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-jxv9-v53f-c79m", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-01T13:23:46.653Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102102" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00813, "percentile": 0.56737, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102102" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:12:42.032Z", "updatedAt": "2026-09-30T20:12:42.032Z" }, { "id": "cve-2026-102149", "url": "https://cveboard.org/i/cve-2026-102149", "urlPt": "https://cveboard.org/pt/i/cve-2026-102149", "json": "https://cveboard.org/i/cve-2026-102149.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.1", "lessThanOrEqual": null }, { "version": "9.5.1", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.1" ] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-01T13:25:55.510Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102149" ], "ghsa": null, "cvss": { "score": 9.4, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00239, "percentile": 0.14797, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102149" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:09:21.510Z", "updatedAt": "2026-09-30T20:09:21.510Z" }, { "id": "cve-2026-102147", "url": "https://cveboard.org/i/cve-2026-102147", "urlPt": "https://cveboard.org/pt/i/cve-2026-102147", "json": "https://cveboard.org/i/cve-2026-102147.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Core", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Core", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.1", "lessThanOrEqual": null }, { "version": "9.5.1", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.1" ] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-01T13:26:51.123Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102147" ], "ghsa": null, "cvss": { "score": 9.3, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00462, "percentile": 0.3976, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Core", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102147" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:09:08.315Z", "updatedAt": "2026-09-30T20:09:08.315Z" }, { "id": "cve-2026-102095", "url": "https://cveboard.org/i/cve-2026-102095", "urlPt": "https://cveboard.org/pt/i/cve-2026-102095", "json": "https://cveboard.org/i/cve-2026-102095.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Kiteworks Email Protection Gateway", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Kiteworks", "product": "Email Protection Gateway", "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "affected", "lessThan": "9.5.0", "lessThanOrEqual": null }, { "version": "9.5.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "9.5.0" ] } ], "omitted": 0, "references": [ { "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f252-4w8q-g74g", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-01T13:27:02.423Z" }, "fix": "listed", "tags": [ "kiteworks" ], "cves": [ "CVE-2026-102095" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "cisa-cg" }, "epss": { "percentage": 0.00408, "percentile": 0.34833, "asOf": "2026-10-26", "by": "FIRST" }, "packages": [], "vendor": "Kiteworks", "product": "Email Protection Gateway", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-102095" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-09-30T20:07:22.551Z", "updatedAt": "2026-09-30T20:07:22.551Z" } ], "tag": { "tag": "kiteworks", "name": "Kiteworks", "kev": null } }