CVEs published by CPANSec

CVEs published by CPANSec (CVE Numbering Authority). 28 tracked.

• CVE-2026-113877 HIGH n/a HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matche
• CVE-2026-18536 HIGH 7.5 UPGRADE Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::
• CVE-2026-60074 HIGH 7.5 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the n
• CVE-2026-60075 HIGH 7.5 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored t
• CVE-2026-66902 CRITICAL 9.8 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an
• CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
• CVE-2026-18108 CRITICAL 9.8 UPGRADE Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accep
• CVE-2026-9487 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM
• CVE-2026-66901 HIGH 7.5 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via u
• CVE-2026-18568 HIGH 7.5 UPGRADE XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr
• CVE-2026-18089 HIGH 7.5 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the r
• CVE-2026-18092 HIGH 8.1 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because n
• CVE-2026-17510 HIGH 7.5 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a
• CVE-2026-19082 HIGH 7.5 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from
• CVE-2026-19566 HIGH 7.5 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IP
• CVE-2026-15534 MEDIUM 5.7 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via a
• CVE-2026-17435 LOW 2.5 File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files
• CVE-2026-16770 CRITICAL 9.8 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the sourc
• CVE-2026-17431 MEDIUM 6.1 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in
• CVE-2026-113811 HIGH n/a Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared
• CVE-2026-112921 HIGH n/a Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent
• CVE-2026-94423 HIGH n/a Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks t
• CVE-2026-94140 HIGH n/a Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync ha
• CVE-2026-108518 HIGH n/a DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed
• CVE-2026-85783 HIGH n/a Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, e
• CVE-2026-112202 HIGH n/a Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. Wit
• CVE-2026-111879 HIGH n/a DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does no
• CVE-2026-113812 HIGH n/a Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to comp

← Back to latest CVEs