Malcolm vulnerabilities | LiveThreat CVE Feed

Product

Malcolm

by CISA · last CVE Oct 8, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities22 In the news2 Timeline

Severity mix

Critical 0High 5Medium 15Low 2

Severity

All severities22 Critical0 High5 Medium15 Low2

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Malcolm to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-90444	8.8	0%	Sep 11	OS Command Injection in Malcolm Affected: before v26.06.0
CVE-2026-107333	8.1	1%	Oct 8	Incorrect Authorization in Malcolm Affected: through 26.07.1
CVE-2026-90456	8.1	0%	Sep 11	Use of default credentials in Malcolm Affected: before v26.06.0
CVE-2026-107337	7.1	0%	Oct 8	Cross-Site Request Forgery in Malcolm Affected: through 26.07.1
CVE-2026-107362	7.1	0%	Oct 8	Server-Side Request Forgery in Malcolm Affected: through 26.07.1
CVE-2026-107335	6.5	0%	Oct 8	Improper Handling of Highly Compressed Data in Malcolm Affected: through 26.07.1
CVE-2026-107336	6.5	0%	Oct 8	Authentication Bypass by Spoofing in Malcolm Affected: through 26.07.1
CVE-2026-90449	6.5	0%	Sep 11	Missing Authentication for Critical Function in Malcolm Affected: before v26.06.0
CVE-2026-90448	6.5	0%	Sep 11	Missing Authorization in Malcolm Affected: before v26.06.0
CVE-2026-90447	6.5	0%	Sep 11	Authentication Bypass by Spoofing in Malcolm Affected: before v26.06.0
CVE-2026-90445	6.5	0%	Sep 11	Path Traversal in Malcolm Affected: before v26.06.0
CVE-2026-90457	6.2	0%	Sep 11	The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is… Affected: before v26.06.0
CVE-2026-90451	5.9	0%	Sep 11	Use of Default Credentials in Malcolm Affected: before v26.06.0
CVE-2026-107334	5.4	0%	Oct 8	Incorrect Authorization in Malcolm Affected: through 26.07.1
CVE-2026-90443	5.4	0%	Sep 11	Cross-site Scripting in Malcolm Affected: before v26.06.0
CVE-2026-90452	5.3	0%	Sep 11	Improper certificate validation in Malcolm Affected: before v26.06.0
CVE-2026-90454	4.3	0%	Sep 11	Missing authorization in Malcolm Affected: before v26.06.0
CVE-2026-90450	4.3	0%	Sep 11	Incorrect Authorization in Malcolm Affected: before v26.06.0
CVE-2026-90446	4.3	0%	Sep 11	Server-Side Request Forgery in Malcolm Affected: before v26.06.0
CVE-2026-107361	4.2	0%	Oct 8	Authentication Bypass Using an Alternate Path or Channel in Malcolm Affected: through 26.07.1
CVE-2026-90455	3.7	0%	Sep 11	Dependency on vulnerable third-party component in Malcolm Affected: before v26.06.0
CVE-2026-90453	3.5	0%	Sep 11	Open Redirect in Malcolm Affected: before v26.06.0