Cisagov vulnerabilities
We track 2 vulnerabilities in Cisagov products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2026.
2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score
Latest Cisagov vulnerabilities
- 7.1 High severity
Malcolm: Incorrect Authorization
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path.
- 8.8 High severity
Malcolm: Unrestricted Upload of File with Dangerous Type
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restric