Technology · Kiteworks
Kiteworks Core vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 33 vulnerabilities in Kiteworks Core: 0 in the last 7 days and 33 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102147, was published on 30 September 2026. Nothing in the last four weeks, down from 33 vulnerabilities in the four before. 0 critical against 2.
- Last 7 days
- 0
- Last 90 days
- 33
- Critical, all time
- 2
- Exploited in the wild
- 0
About Kiteworks Core
Kiteworks Core is a secure file transfer and content management platform.
Latest Kiteworks Core vulnerabilities
- CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interfacecriticalCVSS 9.3
- CVE-2026-102145: Kiteworks Core SSRF via CRLF injectionmediumCVSS 6.6
- CVE-2026-102142: Kiteworks Core remote code execution in notification templatehighCVSS 7.2
- CVE-2026-102141: Kiteworks Core privilege escalation in cluster-management operationsmediumCVSS 6.7
- CVE-2026-102140: Kiteworks Core insufficient verification of data authenticity in importmediumCVSS 4.9
- CVE-2026-102137: Kiteworks Core unrestricted upload of dangerous file typemediumCVSS 4.1
- CVE-2026-102136: Kiteworks Core command execution through configuration injectionmediumCVSS 6.3
- CVE-2026-102134: Kiteworks Core gateway-level API security controls bypassmediumCVSS 5.4
- CVE-2026-102133: Kiteworks Core command injection in repository connectormediumCVSS 6.6
- CVE-2026-102132: Kiteworks Core privilege escalation in administrative importhighCVSS 7.2
- CVE-2026-102129: Kiteworks Core privilege escalation in user-provisioning interfacehighCVSS 7.2
- CVE-2026-102126: Kiteworks Core stored XSS privilege escalationhighCVSS 8.1
- CVE-2026-102124: Kiteworks Core authentication bypass in setup interfacemediumCVSS 6.5
- CVE-2026-102123: Kiteworks Core path traversal in setup interfacehighCVSS 7.4
- CVE-2026-102122: Kiteworks Core incorrect authorization in folder role assignmentmediumCVSS 4.3
- CVE-2026-102120: Kiteworks Core privilege escalation through OS command injectionhighCVSS 8.8
- CVE-2026-102118: Kiteworks Core local privilege escalationhighCVSS 7.8
- CVE-2026-102117: Kiteworks Core remote code execution in remote-support functionalityhighCVSS 7.2
- CVE-2026-102115: Kiteworks Core authentication bypass in password resetcriticalCVSS 9.8
- CVE-2026-102114: Kiteworks Core OS command injectionhighCVSS 7.2
- CVE-2026-102113: Kiteworks Core local privilege escalation in path handlinghighCVSS 7.8
- CVE-2026-102112: Kiteworks Core local privilege escalation to roothighCVSS 7.8
- CVE-2026-102111: Kiteworks improper validation of configurable security-policy settingmediumCVSS 4.9
- CVE-2026-102110: Kiteworks Core missing authentication in setup endpointmediumCVSS 5.9
- CVE-2026-102107: Kiteworks Core authorization bypass in file-request featuremediumCVSS 4.6
Most severe Kiteworks Core vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-102115: Kiteworks Core authentication bypass in password resetcriticalCVSS 9.8
- CVE-2026-102147: Kiteworks Core stored cross-site scripting in administrative interfacecriticalCVSS 9.3
- CVE-2026-102120: Kiteworks Core privilege escalation through OS command injectionhighCVSS 8.8
- CVE-2026-102100: Kiteworks Core stored cross-site scriptinghighCVSS 8.7
- CVE-2026-102092: Kiteworks Core stored XSS in shared content previewhighCVSS 8.7
- CVE-2026-102126: Kiteworks Core stored XSS privilege escalationhighCVSS 8.1
- CVE-2026-102101: Kiteworks Core deserialization of untrusted datahighCVSS 8.1
- CVE-2026-102118: Kiteworks Core local privilege escalationhighCVSS 7.8
- CVE-2026-102113: Kiteworks Core local privilege escalation in path handlinghighCVSS 7.8
- CVE-2026-102112: Kiteworks Core local privilege escalation to roothighCVSS 7.8
Vulnerabilities per week
Nothing in the last four weeks, down from 33 vulnerabilities in the four before. 0 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 33 | 2 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Kiteworks Core vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/kiteworks-core)<a href="https://junglewise.ai/threats/technologies/kiteworks-core"><img src="https://junglewise.ai/threats/technologies/kiteworks-core/badge.svg" alt="Kiteworks Core vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/kiteworks-core.json, and this page as text at https://junglewise.ai/threats/technologies/kiteworks-core.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Kiteworks Core vulnerabilities", https://junglewise.ai/threats/technologies/kiteworks-core, 9 November 2026.