What’s Vulnerable › Products

cisagov Malcolm vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your cisagov Malcolm version is affected

Latest cisagov Malcolm vulnerabilities

• CVE-2026-19671 — Improper handling of highly compressed data (data amplification) in CISA Malcolm (CVSS 6.5)
• CVE-2026-19670 — Incorrect Authorization in CISA Malcolm (CVSS 5.4)
• CVE-2026-63177 — Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC (CVSS 7.1)
• CVE-2026-63134 — Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation (CVSS 5.4)
• CVE-2026-63133 — Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) (CVSS 6.5)
• CVE-2026-55676 — Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component (CVSS 8.8)