# cve.now: Cisa

The newest entries naming Cisa as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107334](https://cve.now/CVE-2026-107334.md): Incorrect Authorization in Malcolm (CVSS 5.4)
- [CVE-2026-107335](https://cve.now/CVE-2026-107335.md): Improper Handling of Highly Compressed Data in Malcolm (CVSS 6.5)
- [CVE-2026-107337](https://cve.now/CVE-2026-107337.md): Cross-Site Request Forgery in Malcolm (CVSS 7.1)
- [CVE-2026-107361](https://cve.now/CVE-2026-107361.md): Authentication Bypass Using an Alternate Path or Channel in Malcolm (CVSS 4.2)
- [CVE-2026-107362](https://cve.now/CVE-2026-107362.md): Server-Side Request Forgery in Malcolm (CVSS 7.1)
- [CVE-2026-107333](https://cve.now/CVE-2026-107333.md): Incorrect Authorization in Malcolm (CVSS 8.1)
- [CVE-2026-107336](https://cve.now/CVE-2026-107336.md): Authentication Bypass by Spoofing in Malcolm (CVSS 6.5)
- [CVE-2026-90457](https://cve.now/CVE-2026-90457.md): The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, a (CVSS 6.9)
- [CVE-2026-90456](https://cve.now/CVE-2026-90456.md): Use of default credentials in Malcolm (CVSS 9.2)
- [CVE-2026-90455](https://cve.now/CVE-2026-90455.md): Dependency on vulnerable third-party component in Malcolm (CVSS 6.3)
- [CVE-2026-90454](https://cve.now/CVE-2026-90454.md): Missing authorization in Malcolm (CVSS 5.3)
- [CVE-2026-90453](https://cve.now/CVE-2026-90453.md): Open Redirect in Malcolm (CVSS 5.1)
- [CVE-2026-90452](https://cve.now/CVE-2026-90452.md): Improper certificate validation in Malcolm (CVSS 6.0)
- [CVE-2026-90451](https://cve.now/CVE-2026-90451.md): Use of Default Credentials in Malcolm (CVSS 8.2)
- [CVE-2026-90450](https://cve.now/CVE-2026-90450.md): Incorrect Authorization in Malcolm (CVSS 5.3)
- [CVE-2026-90449](https://cve.now/CVE-2026-90449.md): Missing Authentication for Critical Function in Malcolm (CVSS 6.9)
- [CVE-2026-90448](https://cve.now/CVE-2026-90448.md): Missing Authorization in Malcolm (CVSS 7.1)
- [CVE-2026-90447](https://cve.now/CVE-2026-90447.md): Authentication Bypass by Spoofing in Malcolm (CVSS 7.1)
- [CVE-2026-90446](https://cve.now/CVE-2026-90446.md): Server-Side Request Forgery in Malcolm (CVSS 5.3)
- [CVE-2026-90445](https://cve.now/CVE-2026-90445.md): Path Traversal in Malcolm (CVSS 7.1)
- [CVE-2026-90444](https://cve.now/CVE-2026-90444.md): OS Command Injection in Malcolm (CVSS 8.7)
- [CVE-2026-90443](https://cve.now/CVE-2026-90443.md): Cross-site Scripting in Malcolm (CVSS 5.3)
- [CVE-2026-43510](https://cve.now/CVE-2026-43510.md): CISA manage.get.gov insecure portfolio administrative privileges (CVSS 5.9)
- [CVE-2025-67634](https://cve.now/CVE-2025-67634.md): Software Acquisition Guide Supplier Response Web Tool XSS (CVSS 4.6)
- [CVE-2025-35436](https://cve.now/CVE-2025-35436.md): CISA Thorium account verification email error handling (CVSS 5.3)
- [CVE-2025-35435](https://cve.now/CVE-2025-35435.md): CISA Thorium download stream divide by zero (CVSS 4.3)
- [CVE-2025-35434](https://cve.now/CVE-2025-35434.md): CISA Thorium does not validate TLS connections to Elasticsearch (CVSS 4.2)
- [CVE-2025-35433](https://cve.now/CVE-2025-35433.md): CISA Thorium does not properly invalidate previously used tokens (CVSS 5.0)
- [CVE-2025-35432](https://cve.now/CVE-2025-35432.md): CISA Thorium does not rate limit account verification email messages (CVSS 5.3)
- [CVE-2025-35431](https://cve.now/CVE-2025-35431.md): CISA Thorium LDAP injection (CVSS 5.4)
- [CVE-2025-35430](https://cve.now/CVE-2025-35430.md): CISA Thorium insecure downloaded file path validation (CVSS 5.0)
- [CVE-2023-7242](https://cve.now/CVE-2023-7242.md): Ethercat Zeek Plugin Out-of-bounds Read (CVSS 8.2)
- [CVE-2023-7243](https://cve.now/CVE-2023-7243.md): Ethercat Zeek Plugin Out-of-bounds Write (CVSS 9.8)
- [CVE-2023-7244](https://cve.now/CVE-2023-7244.md): Ethercat Zeek Plugin Out-of-bounds Write (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cisa
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.