Cisa Malcolm
10 CVEs affecting Cisa Malcolm. Latest disclosed: 2026-09-11. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90457 | | 2026-09-11 | The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file contain… | |
CVE-2026-90456 | | 2026-09-11 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment… | |
CVE-2026-90455 | | 2026-09-11 | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerab… | |
CVE-2026-90454 | | 2026-09-11 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but… | |
CVE-2026-90453 | | 2026-09-11 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… | |
CVE-2026-90452 | | 2026-09-11 | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provide… | |
CVE-2026-90451 | | 2026-09-11 | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis com… | |
CVE-2026-90450 | | 2026-09-11 | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather… | |
CVE-2026-90449 | | 2026-09-11 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that in… | |
CVE-2026-90448 | | 2026-09-11 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which reques… |