PatchTheCVExml\ vulnerabilities
Recent CVEs affecting xml\ products. 3 tracked.
xml\ has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-08-03. Highest priority: CVE-2026-9390 (score 50/100).
- CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
- CVE-2026-9487 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM
- CVE-2026-18568 HIGH 7.5 UPGRADE XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr
FAQ
How do I fix xml\ vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xml\ being exploited right now?
None of the tracked xml\ CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xml\ CVE should I patch first?
CVE-2026-9390 currently ranks highest (50/100): XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in .