CVE-2026-63177

Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cisagov

Products

Malcolm

CVE-2026-100261

Unauthorized Article Visibility Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-100262

Authorization Bypass Allowing Read‑Only Users to Modify Project Notification Templates

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-63134

Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cisagov

Products

Malcolm

CVE-2026-100263

HTML Injection via User‑Agent Header in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-55676

Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cisagov

Products

Malcolm

CVE-2026-88920

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wss4j

CVE-2026-71454

Cross‑Site Scripting Vulnerability in CAPEC‑63 Before 3.0b63

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). This issue affects CAPEC-63: before 3.0b63.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cwe-79 - Cross-site Scripting

Products

Capec-63

CVE-2026-71453

External Control of File Name or Path Leading to Directory Traversal in Johnson Controls EasyIO FS32

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-71448

Insecure Default Initialization Allows Authentication Abuse in EasyIO FS32

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-64893

Cleartext Transmission of Sensitive Information in Johnson Controls EasyIO NEO Enabling Man‑in‑the‑Middle Attacks

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Neo

CVE-2026-64892

Sensitive Information Exposure via Common Resource Locations in Johnson Controls Easy IO Neo

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easy Io Neo

CVE-2026-34494

Neo Series MVP2 On‑Chip Debug Interface Allows Data Collection from Common Resource Locations

- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Neo Series Mvp2

CVE-2026-34493

ON‑Chip Debug Interface Vulnerability Exposing Common Resource Data

- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easyio Fs32

CVE-2026-18397

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Thales

Products

Sconnect

CVE-2026-15896

Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Webrehab Wordpress-extensions

Products

Super Forms – Drag & Drop Form Builder Super Forms

CVE-2026-104054

calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Calcom

Products

Cal.diy

CVE-2026-103765

Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kvcache-ai

Products

Mooncake

CVE-2026-103097

GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Geovision Geovision Inc.

Products

Gv-eye Gv-eye

CVE-2026-103096

GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Geovision Geovision Inc.

Products

Gv-eye Gv-eye