Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: cisagov Clear all filters
TI-2026-15970 CVE-2026-19671 · GHSA-3wrw-4pcx-6p2g

Improper handling of highly compressed data (data amplification) in CISA Malcolm

Priority MEDIUM 64

Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00436 Published 2026-08-18 No fix listed CWE-409
TI-2026-15969 CVE-2026-19670 · GHSA-4887-2gc3-6j9r

Incorrect Authorization in CISA Malcolm

Priority MEDIUM 57

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-08-18 No fix listed CWE-863