[ Vendor · 7 CVEs ]
CISA
CVEs affecting CISA published in the last 30 days, plus any CISA CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107361 | 8 Oct 2026 | CVSS 4.2 | CISA MalcolmThe Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces… | |
| CVE-2026-107362 | 8 Oct 2026 | CVSS 7.1 | CISA MalcolmMalcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream… | |
| CVE-2026-107336 | 8 Oct 2026 | CVSS 6.5 | CISA MalcolmMalcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive… | |
| CVE-2026-107337 | 8 Oct 2026 | CVSS 7.1 | CISA MalcolmThe Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker… | |
| CVE-2026-107333 | 8 Oct 2026 | CVSS 8.1 | CISA MalcolmMalcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC)… | |
| CVE-2026-107334 | 8 Oct 2026 | CVSS 5.4 | CISA MalcolmMalcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin… | |
| CVE-2026-107335 | 8 Oct 2026 | CVSS 6.5 | CISA MalcolmMalcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when… |