Skip to content
OpenAdvisories

Vendor

CISAgov

6 known vulnerabilities.

Products

Malcolm 6
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-63177

    Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path…

    CISAgov Malcolm
  • High 8.8
    CVE-2026-55676

    Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

    Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restri…

    CISAgov Malcolm