CVE-2026-23635
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Mar 25, 2026
CISA due date
—
The record
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54784 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-523
- CVE-2026-8668 A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access… CWE-523
- CVE-2026-36610 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over… CWE-523
- CVE-2026-8673 Unprotected transport of credentials vulnerability in syslink software AG Avantra on… CWE-523
- GHSA-vrjc-q2fh-6x9h Spinnaker vulnerable to SSRF due to improper restrictions on http from user input CWE-523
- CVE-2025-61916 Spinnaker is an open source, multi-cloud continuous delivery platform. CWE-523
- CVE-2025-66029 Open OnDemand provides remote web access to supercomputers. CWE-523
- CVE-2025-64309 The affected product discloses device telemetry, configuration, and sensitive information… CWE-523