CVE-2026-102150

HighCVSS 7.2/10Last modified Oct 7, 2026

Description

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1021558.5An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicCVE-2026-1021566.8Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, CVE-2026-1021575.9An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network userCVE-2026-1021586.5Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated networCVE-2026-1021599.8An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internaCVE-2026-102163.7A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/CVE-2026-1021607.2An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submiCVE-2026-1021618.8An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwarCVE-2026-1021628.8On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wirCVE-2026-1021638.8On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequencyCVE-2026-1021643.1On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wiCVE-2026-1021657.5On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to