Skip to content

CVE record · 2 sources

CVE-2026-107337

CVSS 7.1

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)).

Vendor: Apple
Product: ios
CVSS: 7.1
EPSS: 0.010 (p62)
Exposure class: Mobile OS, Developer platform

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

21

CISA advisory CISA 16d ago

CISA Malcolm

The following versions of CISA Malcolm are affected: Malcolm Malcolm CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF)…

CVSS 3.1 CVE-2026-107336 CVE-2026-107333 CVE-2026-107362+4 more Apple
21

CVE NVD 23d ago

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)).

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via…

CVSS 7.1 CVE-2026-107337 Apple