Log in Start free

CISA

Products

ProductCVEsExploitedLatest
Malcolm22–Oct 8, 2026
Thorium7–Sep 17, 2025
Industrial Control Systems Network Protocol Parsers (ICSNPP) - Ethercat Plugin for Zeek3–Mar 1, 2024
manage.get.gov1–May 7, 2026
Software Acquisition Guide Tool1–Dec 12, 2025

Exploited and recent CVEs

  • CVE-2026-107334 Medium 5.4 Incorrect Authorization in Malcolm 0.2%
  • CVE-2026-107335 Medium 6.5 Improper Handling of Highly Compressed Data in Malcolm 0.5%
  • CVE-2026-107337 High 7.1 Cross-Site Request Forgery in Malcolm 0.1%
  • CVE-2026-107361 Medium 4.2 Authentication Bypass Using an Alternate Path or Channel in Malcolm 0.2%
  • CVE-2026-107362 High 7.1 Server-Side Request Forgery in Malcolm 0.4%
  • CVE-2026-107333 High 8.1 Incorrect Authorization in Malcolm 1.2%
  • CVE-2026-107336 Medium 6.5 Authentication Bypass by Spoofing in Malcolm 0.2%
  • CVE-2026-90457 Medium 6.2 The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions <0.1%
  • CVE-2026-90456 High 8.1 Use of default credentials in Malcolm 0.3%
  • CVE-2026-90455 Low 3.7 Dependency on vulnerable third-party component in Malcolm 0.2%
  • CVE-2026-90454 Medium 4.3 Missing authorization in Malcolm 0.2%
  • CVE-2026-90453 Low 3.5 Open Redirect in Malcolm 0.2%
  • CVE-2026-90452 Medium 5.3 Improper certificate validation in Malcolm <0.1%
  • CVE-2026-90451 Medium 5.9 Use of Default Credentials in Malcolm 0.3%
  • CVE-2026-90450 Medium 4.3 Incorrect Authorization in Malcolm 0.2%
  • CVE-2026-90449 Medium 6.5 Missing Authentication for Critical Function in Malcolm 0.2%
  • CVE-2026-90448 Medium 6.5 Missing Authorization in Malcolm 0.2%
  • CVE-2026-90447 Medium 6.5 Authentication Bypass by Spoofing in Malcolm 0.2%
  • CVE-2026-90446 Medium 4.3 Server-Side Request Forgery in Malcolm 0.2%
  • CVE-2026-90445 Medium 6.5 Path Traversal in Malcolm 0.3%
  • CVE-2026-90444 High 8.8 OS Command Injection in Malcolm 0.3%
  • CVE-2026-90443 Medium 5.4 Cross-site Scripting in Malcolm 0.2%
  • CVE-2026-43510 Medium 5.9 CISA manage.get.gov insecure portfolio administrative privileges 0.4%
  • CVE-2025-67634 Medium 4.4 Software Acquisition Guide Supplier Response Web Tool XSS 0.2%
  • CVE-2025-35436 Medium 5.3 CISA Thorium account verification email error handling 0.6%
  • CVE-2025-35435 Medium 4.3 CISA Thorium download stream divide by zero 0.4%
  • CVE-2025-35434 Medium 4.2 CISA Thorium does not validate TLS connections to Elasticsearch 0.2%
  • CVE-2025-35433 Medium 5.0 CISA Thorium does not properly invalidate previously used tokens 0.3%
  • CVE-2025-35432 Medium 5.3 CISA Thorium does not rate limit account verification email messages 0.6%
  • CVE-2025-35431 Medium 5.4 CISA Thorium LDAP injection 0.3%