Signals
Back to database
Soon71High7.1VulnerabilityCVE-2026-107337No patch link observed

CVE-2026-107337 — The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)).

Published Oct 8, 2026, 06:17 PM UTCIngested 9h agoSource NVD(cve-db)CVE-2026-107337

Description

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

CVSS v3.1 base metrics

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
7.1

High severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

Low

Attack Complexity

PR

None

Privileges Required

UI

Required

User Interaction

S

Unchanged

Scope

C

None

Confidentiality

I

High

Integrity

A

High

Availability

References

Related threats

same CWE or vendor
Medium

CVE-2026-107831 — Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing …

CVE-2026-107831 · 6h ago

Medium

CVE-2026-78388 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery whi…

CVE-2026-78388 · 7h ago

High

CVE-2026-107295 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI.

CVE-2026-107295 · 11h ago

High

CVE-2026-66479 — Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: fr…

CVE-2026-66479 · 15h ago

High

CVE-2026-62142 — Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a th…

CVE-2026-62142 · 15h ago

High

CVE-2026-106611 — Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: …

CVE-2026-106611 · 15h ago