Skip to content
Kiteworks Security-advisories vulnerabilities
-
kiteworks security-advisories
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
CVE-2026-81515
Fix available
7.5 High
-
kiteworks security-advisories
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
CVE-2026-81516
Fix available
7.5 High
-
kiteworks security-advisories
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
CVE-2026-81868
Fix available
6.5 Medium
-
kiteworks security-advisories
Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
CVE-2026-75523
Fix available
5.9 Medium
-
accellion kiteworks, kiteworks security-advisories +1 more
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
CVE-2026-24754
5.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Propfind requests for file comments allowed to load comments for other files
CVE-2026-45810
Fix available
6.8 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
CVE-2026-45722
7.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Bypass of second factor authentication on DAV endpoints
CVE-2026-45691
Fix available
5.9 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
CVE-2026-45690
Fix available
5.9 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
CVE-2026-45545
8.2 High
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
CVE-2026-45544
4.3 Medium
-
nextcloud forms, kiteworks security-advisories +1 more
Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
CVE-2026-45543
5.3 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
CVE-2026-45286
4.3 Medium
-
nextcloud user oidc, kiteworks security-advisories +1 more
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
CVE-2026-45284
4.6 Medium
-
kiteworks security-advisories, nextcloud server +1 more
Nextcloud: Hidden Public Link creation when sharing to a Team External Member
CVE-2026-45285
6.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Files Lock app allows users to lock and unlock files of other users
CVE-2026-45283
6.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access
CVE-2026-45282
6.5 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
CVE-2026-45281
Fix available
8.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Limited path traversal via template API if using `{lang}` in config
CVE-2026-45279
4.4 Medium
-
nextcloud user oidc, kiteworks security-advisories +1 more
Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
CVE-2026-45278
3.3 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
CVE-2026-45277
3.3 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
CVE-2026-45275
6.5 Medium
-
kiteworks security-advisories
Nextcloud: Missing permission check for from submissions
CVE-2026-45267
6.5 Medium
-
kiteworks security-advisories
Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling
CVE-2026-45266
3.5 Low
-
kiteworks security-advisories
Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
CVE-2026-45159
3.5 Low
-
kiteworks security-advisories
Nextcloud: Valid share tokens allow to access tempory upload files of share owner
CVE-2026-45157
Fix available
6.3 Medium
-
kiteworks security-advisories
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
CVE-2026-45156
Public exploit
8.1 High
-
kiteworks security-advisories
Nextcloud: Private circle can be added to another circle via API
CVE-2026-45155
2.6 Low
-
kiteworks security-advisories
Nextcloud: Improper Access Control in Collectives
CVE-2026-45154
2.6 Low
-
kiteworks security-advisories
Nextcloud: PIN bypass in PassCodeActivity via back button
CVE-2026-45153
Fix available
4.6 Medium
-
kiteworks security-advisories
Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
CVE-2026-45264
4.3 Medium
-
accellion kiteworks, kiteworks security-advisories +1 more
Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability
CVE-2026-28272
8.1 High
-
accellion kiteworks, kiteworks security-advisories +1 more
Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)
CVE-2026-28271
6.5 Medium
-
accellion kiteworks, kiteworks security-advisories +1 more
Kiteworks Core has an Unrestricted Upload of File with Dangerous Type
CVE-2026-28270
4.9 Medium
-
accellion kiteworks, kiteworks security-advisories +1 more
Kiteworks Core has an OS Command Injection
CVE-2026-28269
5.9 Medium
-
kiteworks security-advisories, nextcloud two-factor webauthn +1 more
Nextcloud Twofactor WebAuthn app was updated based on public key
CVE-2025-66558
3.1 Low
-
nextcloud talk, kiteworks security-advisories +1 more
Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
CVE-2025-66556
3.5 Low
-
nextcloud contacts, kiteworks security-advisories +1 more
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
CVE-2025-66554
3.5 Low
-
nextcloud desktop, kiteworks security-advisories +1 more
Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
CVE-2025-66549
Fix available
2.4 Low
-
kiteworks security-advisories, nextcloud group folders +1 more
Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
CVE-2025-66545
3.5 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud Approval app allows users to request approval for other users file
CVE-2025-66515
2.7 Low
-
nextcloud mail, kiteworks security-advisories +1 more
Nextcloud Mail stored HTML injection in subject text
CVE-2025-66514
3.5 Low
-
nextcloud deck, kiteworks security-advisories +1 more
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
CVE-2025-66557
5.4 Medium
-
nextcloud deck, kiteworks security-advisories +1 more
Nextcloud Deck app allows to spoof file extensions by using RTLO characters
CVE-2025-66548
3.3 Low
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables app allowed users to view columns metadata information of any table
CVE-2025-66553
4.3 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users
CVE-2025-66551
6.3 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables app share information not limited to relevant users
CVE-2025-66513
4.3 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar attachments of local files are offered to downloaded
CVE-2025-66550
5.7 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar app allowed booking appointments without the generated token
CVE-2025-66546
3.3 Low
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar app used predictable proposal participant tokens
CVE-2025-66511
4.8 Medium
- Show olderLoading…