Vulnerabilidades — Alertas SI

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102102] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves…

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102103] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves…

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102104] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs …

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102105] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders m…

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102106] Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administr…

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and…

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102108] An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serializ…

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102109] A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the…

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature i…

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102095] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cl…

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102096] Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticat…

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102097] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kite…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102098] Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerabi…

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected repor…

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102099] Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction o…

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrat…

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102100] Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-sit…

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account ta…

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102101] Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserializ…

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on …

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102089] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness i…

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102091] Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that c…

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102092] Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could al…

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102093] Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not corr…

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102094] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does …

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentia…

M Alto vulnerabilidad

30/09/2026

[CVE-2023-54403] Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemailda…

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files cont…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?