CVE-2026-102144

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-306CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1021456.6An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant CVE-2026-1021466.5An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controllCVE-2026-1021479.3A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later eCVE-2026-1021499.4Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacCVE-2026-102154.3A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htCVE-2026-1021507.2A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially useCVE-2026-1021558.5An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicCVE-2026-1021566.8Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, CVE-2026-1021575.9An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network userCVE-2026-1021586.5Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networCVE-2026-1021599.8An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internaCVE-2026-102163.7A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/
CVE-2026-102144: Medium severity, CVSS 5.3 | Vulnix