Security Vulnerabilities
eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue.
# Affected Scope
Cross-scope visibility of titles.
No confirmed bypass of content-level access controls
# Preconditions
An authenticated user account
No special privileges required beyond standard access
# Impact
This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.
CVSS Score
4.3
EPSS Score
0.002
Published
2026-06-01
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS Score
7.6
EPSS Score
0.007
Published
2026-06-01
Memory corruption while processing IOCTL calls for escape operations.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-06-01
Memory corruption while processing multiple IOCTL command for escape operations.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-06-01
Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-06-01
Memory corruption while using Strongbox due to missing bounds check.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-06-01
Memory corruption while using Strongbox due to buffer overflow.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-06-01
Memory Corruption when processing fastboot commands to set display mode.
CVSS Score
7.2
EPSS Score
0.001
Published
2026-06-01
Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS Score
8.2
EPSS Score
0.003
Published
2026-06-01
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS Score
6.5
EPSS Score
0.002
Published
2026-06-01