CVE WatchOct 1, 2026

CVE-2026-102111

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set t

CVSS

4.9

Medium

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Published: Sep 30, 2026 · Last modified: Oct 1, 2026 · CWE-1284

EPSS · 30d

0.2%EPSS · 30 days0.4%

2026-10-012026-10-04

Technical description

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1030658.2 HIG

9.9%

——3Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.2d CVE-2026-94646—

37.6%

——11Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.3d CVE-2026-94636—

34.6%

——10Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.3d CVE-2026-94645—

34.6%

——10Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.3d CVE-2026-91137—

34.6%

——10Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.3d CVE-2026-1034848.8 HIG

34.3%

——10IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.3d