These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-19671 is a vulnerability in Malcolm's upload-processing pipeline that allows an authenticated user to upload a highly compressible file, which can decompress to an effectively unbounded size on disk, exhausting the shared Docker volume and disrupting the platform for all users. The vulnerability is caused by the lack of limits on single-stream compressed formats (.gz, .bz2, .xz, .lz) in Malcolm's [truncated]
CVE-2026-63177 is a high-severity vulnerability in the Malcolm network traffic analysis tool suite. An authenticated low-privilege user can exploit this vulnerability by prepending a traversal segment to the request URI, allowing access to restricted backends while bypassing role-based access control. The issue was fixed in version 26.07.0. This vulnerability allows an attacker to bypass access control an [truncated]
CVE-2026-63134 is a vulnerability in the Malcolm network traffic analysis tool suite. An uploaded malicious archive can cause the filebeat processing container to create directories outside the intended extraction directory due to a lack of traversal protection in the `safe-extract.py` script. This issue was fixed in version 26.07.0. Defenders should assess exposure and prioritize upgrading to the fixed v [truncated]
A vulnerability in Malcolm, a network traffic analysis tool suite, allows for a denial of service (DoS) attack. Prior to version 26.07.0, the `safe-extract.py` script extracts uploaded archives without limits on entry count, directory depth, total entries, or output size. A malicious archive with a large number of directory or file entries can cause the filebeat processing container to create an unbounded [truncated]
CVE-2026-55676 debrief based on CVE Program and NVD records. The vulnerability is in Malcolm's file-upload component, allowing arbitrary PHP execution as www-data due to an empty allow-list for file types and a filename sanitizer that keeps the .php extension intact. Users with the ROLE_UPLOAD role are affected. The issue is fixed in version 26.06.1. A detailed review of the CVE Program and NVD records in [truncated]