Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
141 results · page 2 of 3
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write.CVE-2026-102099 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection.CVE-2026-102098 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution.CVE-2026-102097 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose conCVE-2026-102096 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery.CVE-2026-102095 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.1
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing CVE-2026-102094 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could aCVE-2026-102093 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that execCVE-2026-102092 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the sCVE-2026-102091 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.5
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Core before version 9.5.1 is vulnerable to Content Injection.CVE-2026-102090 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.3
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticatedCVE-2026-102089 · Other software · Kiteworks · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.2
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.
- Product
- Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Sep 30, 2026Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.CVE-2026-96349 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.CVE-2026-93513 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLCVE-2026-90647 · Other software · Kalkitech · reported by MITRECritical 9.1
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
- Product
- ASE2000 V2 Communication Test Set
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.CVE-2026-81805 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2026Kite is a Kubernetes dashboard.CVE-2026-53487 · Other software · kite-org · reported by GitHubMedium 4.3
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.
- Product
- kite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Anki is a program for creating and reviewing flashcards.CVE-2026-64677 · Other software · ankitects · reported by GitHubMedium 5.9
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal. This issue is fixed in version 25.09.3.
- Product
- anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Anki is a program for creating and reviewing flashcards.CVE-2026-59153 · Other software · ankitects · reported by GitHubLow 2.1
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.
- Product
- anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Anki is a program for creating and reviewing flashcards.CVE-2026-58266 · Other software · ankitects · reported by GitHubMedium 6.5
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.
- Product
- anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Cookiteer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68886 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.
- Product
- Cookiteer
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Cookiteer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24782 · Other software · kiteworks · reported by GitHubHigh 7.6
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24761 · Other software · kiteworks · reported by GitHubLow 3.7
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24756 · Other software · kiteworks · reported by GitHubMedium 4.3
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24755 · Other software · kiteworks · reported by GitHubMedium 5.4
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24754 · Other software · kiteworks · reported by GitHubMedium 5.4
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24753 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24752 · Other software · kiteworks · reported by GitHubHigh 8.2
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-24751 · Other software · kiteworks · reported by GitHubHigh 8.2
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Kiteworks is a private data network (PDN).CVE-2026-23638 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2026Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploitCVE-2020-37247 · Other software · Kite · reported by VulnCheckHigh 8.5
Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the Program Files directory to be executed with LocalSystem privileges when the service starts.
- Product
- Kite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comkite.com
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-29092 · Other software · kiteworks · reported by GitHubMedium 4.9
Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Kiteworks Email Protection Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-23636 · Other software · kiteworks · reported by GitHubMedium 5.5
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-23635 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-24750 · Other software · kiteworks · reported by GitHubHigh 7.6
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
- Product
- Secure Data Forms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Kiteworks is a private data network (PDN).CVE-2026-23514 · Other software · kiteworks · reported by GitHubHigh 8.8
Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Kiteworks is a private data network (PDN).CVE-2026-28272 · Other software · kiteworks · reported by GitHubHigh 8.1
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Kiteworks is a private data network (PDN).CVE-2026-28271 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Kiteworks is a private data network (PDN).CVE-2026-28270 · Other software · kiteworks · reported by GitHubMedium 4.9
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Kiteworks is a private data network (PDN).CVE-2026-28269 · Other software · kiteworks · reported by GitHubMedium 5.9
Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitraCVE-2020-36958 · Other software · Kite · reported by VulnCheckHigh 8.5
Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Kite\KiteService.exe' to inject malicious executables and escalate privileges on the system.
- Product
- Kite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comkite.com
Nov 28, 2025Kiteworks is a private data network (PDN).CVE-2025-53939 · Other software · kiteworks · reported by GitHubMedium 6.3
Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Kiteworks MFT orchestrates end-to-end file transfer workflows.CVE-2025-53900 · Other software · kiteworks · reported by GitHubMedium 6.5
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Kiteworks MFT orchestrates end-to-end file transfer workflows.CVE-2025-53899 · Other software · kiteworks · reported by GitHubHigh 7.2
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Kiteworks MFT orchestrates end-to-end file transfer workflows.CVE-2025-53897 · Other software · kiteworks · reported by GitHubMedium 6.8
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Kiteworks MFT orchestrates end-to-end file transfer workflows.CVE-2025-53896 · Other software · kiteworks · reported by GitHubHigh 7.1
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnameCVE-2025-62187 · Other software · Ankitects · reported by MITRELow 2.9
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).
- Product
- Anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.CVE-2025-62186 · Other software · Ankitects · reported by MITREMedium 6.7
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
- Product
- Anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link iCVE-2025-62185 · Other software · Ankitects · reported by MITREMedium 6.7
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.
- Product
- Anki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability was found in Ackites KillWxapkg up to 2.4.1.CVE-2025-5031 · Other software · Ackites · reported by VulDBLow 2.3
A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxapkg File Decompression Handler. The manipulation leads to resource consumption. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- KillWxapkg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability was found in Ackites KillWxapkg up to 2.4.1.CVE-2025-5030 · Other software · Ackites · reported by VulDBLow 2.3
A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- KillWxapkg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.