CISA
CISA Security Releases - October 2026
cisa-2026-10 Oct 1, 2026 Source: Vendor
CISA security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-107335
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
14 lines
Showing 1–14 of 14
CVE-2026-107335
BR2026-0000-028988
Malcolm
unclaimed
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarch...
Credited as Seth Grover
CVE-2026-107335
BR2026-0000-028989
Malcolm
unclaimed
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarch...
Credited as tinyb0y
CVE-2026-107333
BR2026-0000-031209
Malcolm
unclaimed
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic....
Credited as Seth Grover
CVE-2026-107333
BR2026-0000-031210
Malcolm
unclaimed
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic....
Credited as scofaild23
CVE-2026-107334
BR2026-0000-031211
Malcolm
unclaimed
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, u...
Credited as Seth Grover
CVE-2026-107334
BR2026-0000-031212
Malcolm
unclaimed
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, u...
Credited as tinyb0y
CVE-2026-107336
BR2026-0000-031213
Malcolm
unclaimed
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-...
Credited as Seth Grover
CVE-2026-107336
BR2026-0000-031214
Malcolm
unclaimed
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-...
Credited as Santosh Kumar Puppala
CVE-2026-107337
BR2026-0000-031215
Malcolm
unclaimed
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arb...
Credited as Seth Grover
CVE-2026-107337
BR2026-0000-031216
Malcolm
unclaimed
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arb...
Credited as Pavan Nallamothu
CVE-2026-107361
BR2026-0000-031217
Malcolm
unclaimed
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header fro...
Credited as Seth Grover
CVE-2026-107361
BR2026-0000-031218
Malcolm
unclaimed
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header fro...
Credited as Pavan Nallamothu
CVE-2026-107362
BR2026-0000-031220
Malcolm
unclaimed
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.ph...
Credited as Seth Grover
CVE-2026-107362
BR2026-0000-031221
Malcolm
unclaimed
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.ph...
Credited as Pavan Nallamothu