CVE-2026-102134
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentic
CVSS
5.4
Medium
EPSS
0.2%
p10
KEV
—
Exploit Today
3
0-100
Published: Sep 30, 2026 · Last modified: Oct 1, 2026 · CWE-420
0.2%EPSS · 30 days0.3%
2026-10-012026-10-21
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1050089.0 CRI47.9%
——14No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.6dCVE-2026-619093.5 LOW9.9%
——3An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.36dCVE-2026-776395.3 MED31.9%
——10Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.4dCVE-2026-402178.8 HIG88.8%
——27LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.100dCVE-2026-353882.5 LOW12.7%
——4OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.90dCVE-2025-664325.0 MED12.5%
——4In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.4d