Advisories

CISA Malcolm

The following versions of CISA Malcolm are affected: Malcolm Malcolm CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification) Background Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabiliti

Read at CISA Cybersecurity Advisories

Vendor

Apple

CVSS

3.1

EPSS

0.010 (p62)

Exposure class

Mobile OS

• CISA Cybersecurity Advisories (cisa.gov)
• CVE-2026-107336 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107333 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107362 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107361 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107337 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 16
   CVE NVD 23d ago

   Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream…

   CVSS 7.1 CVE-2026-107362
2. 14
   CVE NVD 23d ago

   The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces…

   CVSS 4.2 CVE-2026-107361 F5
3. 21
   CVE NVD 23d ago

   The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)).

   CVSS 7.1 CVE-2026-107337 Apple
4. 14
   CVE NVD 23d ago

   Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive…

   CVSS 6.5 CVE-2026-107336 F5
5. 9
   CVE NVD 23d ago

   Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when…

   CVSS 6.5 CVE-2026-107335
6. 14
   CVE NVD 23d ago

   Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin…

   CVSS 5.4 CVE-2026-107334 F5
7. 21
   CVE NVD 23d ago

   Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC)…

   CVSS 8.1 CVE-2026-107333 F5
8. 16
   CISA advisory CISA 30d ago

   CISA Malcolm

   CVSS 3.1 CVE-2026-90443CVE-2026-90444CVE-2026-90445+12 more Microsoft