# Accellion Kiteworks


- [CVE-2026-102115](https://insights.sbomify.com/CVE-2026-102115/): Kiteworks Core Authentication Bypass in the Password Reset Workflow (critical 9.8)
- [CVE-2026-102149](https://insights.sbomify.com/CVE-2026-102149/): Kiteworks Email Protection Gateway Improper Access Control (critical 9.4)
- [CVE-2026-102147](https://insights.sbomify.com/CVE-2026-102147/): Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) (critical 9.3)
- [CVE-2026-102095](https://insights.sbomify.com/CVE-2026-102095/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102102](https://insights.sbomify.com/CVE-2026-102102/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102103](https://insights.sbomify.com/CVE-2026-102103/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102104](https://insights.sbomify.com/CVE-2026-102104/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102105](https://insights.sbomify.com/CVE-2026-102105/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102106](https://insights.sbomify.com/CVE-2026-102106/): Kiteworks Email Protection Gateway improper authentication (critical 9.1)
- [CVE-2026-102120](https://insights.sbomify.com/CVE-2026-102120/): Kiteworks Core OS Command Injection (high 8.8)
- [CVE-2026-102125](https://insights.sbomify.com/CVE-2026-102125/): Kiteworks Core Sandbox Escape (high 8.8)
- [CVE-2026-23514](https://insights.sbomify.com/CVE-2026-23514/): Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/accellion/kiteworks/