https://vulnogram.org/ Most recent CVEs assigned by CPAN Security Group (cpansec). https://vulnogram.org/seaview/icons/cpansec.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-112202 https://vulnogram.org/CVE-2026-112202 Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads… Tue, 20 Oct 2026 22:37:43 GMT https://vulnogram.org/CVE-2026-85783 https://vulnogram.org/CVE-2026-85783 Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. The header parser accepts any number of recipient stanzas, and unwrap_file_k… Tue, 20 Oct 2026 21:29:03 GMT https://vulnogram.org/CVE-2026-111879 https://vulnogram.org/CVE-2026-111879 DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that… Tue, 20 Oct 2026 21:24:00 GMT https://vulnogram.org/CVE-2026-108518 https://vulnogram.org/CVE-2026-108518 DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's… Tue, 20 Oct 2026 21:23:13 GMT https://vulnogram.org/CVE-2026-113812 https://vulnogram.org/CVE-2026-113812 Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose privat… Tue, 20 Oct 2026 21:07:44 GMT https://vulnogram.org/CVE-2026-111946 https://vulnogram.org/CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modifi… Mon, 19 Oct 2026 20:54:56 GMT https://vulnogram.org/CVE-2026-110688 https://vulnogram.org/CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. in… Mon, 19 Oct 2026 18:12:25 GMT https://vulnogram.org/CVE-2026-110687 https://vulnogram.org/CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the compa… Mon, 19 Oct 2026 18:12:22 GMT https://vulnogram.org/CVE-2026-110686 https://vulnogram.org/CVE-2026-110686 Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references… Mon, 19 Oct 2026 18:12:19 GMT https://vulnogram.org/CVE-2026-110685 https://vulnogram.org/CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Bo… Mon, 19 Oct 2026 18:12:17 GMT https://vulnogram.org/CVE-2026-110684 https://vulnogram.org/CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed… Mon, 19 Oct 2026 18:12:13 GMT https://vulnogram.org/CVE-2026-110682 https://vulnogram.org/CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no clo… Mon, 19 Oct 2026 18:12:09 GMT https://vulnogram.org/CVE-2026-110681 https://vulnogram.org/CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created,… Mon, 19 Oct 2026 18:12:05 GMT https://vulnogram.org/CVE-2026-110680 https://vulnogram.org/CVE-2026-110680 Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects… Mon, 19 Oct 2026 18:12:01 GMT https://vulnogram.org/CVE-2026-110678 https://vulnogram.org/CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progre… Mon, 19 Oct 2026 18:11:58 GMT https://vulnogram.org/CVE-2026-110677 https://vulnogram.org/CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra re… Mon, 19 Oct 2026 18:11:53 GMT https://vulnogram.org/CVE-2026-110676 https://vulnogram.org/CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the… Mon, 19 Oct 2026 18:11:45 GMT https://vulnogram.org/CVE-2026-110675 https://vulnogram.org/CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stor… Mon, 19 Oct 2026 18:11:35 GMT https://vulnogram.org/CVE-2026-110674 https://vulnogram.org/CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored a… Mon, 19 Oct 2026 18:11:25 GMT https://vulnogram.org/CVE-2026-110673 https://vulnogram.org/CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged va… Mon, 19 Oct 2026 18:11:15 GMT https://vulnogram.org/CVE-2026-110672 https://vulnogram.org/CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into… Mon, 19 Oct 2026 18:11:08 GMT https://vulnogram.org/CVE-2026-78497 https://vulnogram.org/CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and… High Sun, 18 Oct 2026 11:32:05 GMT https://vulnogram.org/CVE-2026-110759 https://vulnogram.org/CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the ne… Critical Network Exploitable Fri, 16 Oct 2026 22:08:23 GMT https://vulnogram.org/CVE-2026-110758 https://vulnogram.org/CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without… High Network Exploitable Fri, 16 Oct 2026 22:08:10 GMT https://vulnogram.org/CVE-2026-110757 https://vulnogram.org/CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl se… Critical Network Exploitable Fri, 16 Oct 2026 22:07:56 GMT https://vulnogram.org/CVE-2026-110756 https://vulnogram.org/CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid… Critical Network Exploitable Fri, 16 Oct 2026 22:07:37 GMT https://vulnogram.org/CVE-2026-110755 https://vulnogram.org/CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line end… High Network Exploitable Fri, 16 Oct 2026 22:07:10 GMT https://vulnogram.org/CVE-2026-110754 https://vulnogram.org/CVE-2026-110754 Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a s… Medium Network Exploitable Fri, 16 Oct 2026 22:06:46 GMT https://vulnogram.org/CVE-2026-110753 https://vulnogram.org/CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a re… Critical Network Exploitable Fri, 16 Oct 2026 22:06:23 GMT https://vulnogram.org/CVE-2026-110752 https://vulnogram.org/CVE-2026-110752 Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any d… High Network Exploitable Fri, 16 Oct 2026 22:06:03 GMT https://vulnogram.org/CVE-2026-107794 https://vulnogram.org/CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to… High Network Exploitable Sat, 10 Oct 2026 12:45:19 GMT https://vulnogram.org/CVE-2013-10076 https://vulnogram.org/CVE-2013-10076 ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading t… High Network Exploitable Sat, 10 Oct 2026 12:44:48 GMT https://vulnogram.org/CVE-2026-107373 https://vulnogram.org/CVE-2026-107373 ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ argumen… Critical Network Exploitable Sat, 10 Oct 2026 12:44:08 GMT https://vulnogram.org/CVE-2026-104380 https://vulnogram.org/CVE-2026-104380 Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches… Medium Network Exploitable Tue, 06 Oct 2026 01:13:14 GMT https://vulnogram.org/CVE-2026-19954 https://vulnogram.org/CVE-2026-19954 Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from low… Medium Network Exploitable Mon, 05 Oct 2026 06:54:09 GMT https://vulnogram.org/CVE-2019-25777 https://vulnogram.org/CVE-2019-25777 YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing re… High Network Exploitable Mon, 05 Oct 2026 06:50:17 GMT https://vulnogram.org/CVE-2017-20285 https://vulnogram.org/CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goe… Critical Network Exploitable Mon, 05 Oct 2026 06:49:17 GMT https://vulnogram.org/CVE-2026-102505 https://vulnogram.org/CVE-2026-102505 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested chan… Medium Thu, 01 Oct 2026 13:11:51 GMT https://vulnogram.org/CVE-2026-102504 https://vulnogram.org/CVE-2026-102504 Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with… High Network Exploitable Thu, 01 Oct 2026 13:11:38 GMT https://vulnogram.org/CVE-2026-80490 https://vulnogram.org/CVE-2026-80490 Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings v… Wed, 30 Sep 2026 15:20:45 GMT https://vulnogram.org/CVE-2026-85644 https://vulnogram.org/CVE-2026-85644 XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using Sv… High Network Exploitable Mon, 28 Sep 2026 16:09:02 GMT https://vulnogram.org/CVE-2026-88816 https://vulnogram.org/CVE-2026-88816 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has be… High Network Exploitable Mon, 28 Sep 2026 16:04:40 GMT https://vulnogram.org/CVE-2026-88815 https://vulnogram.org/CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An inte… Medium Mon, 28 Sep 2026 16:04:22 GMT https://vulnogram.org/CVE-2026-95811 https://vulnogram.org/CVE-2026-95811 Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRul… Medium Fri, 25 Sep 2026 01:31:22 GMT https://vulnogram.org/CVE-2026-92289 https://vulnogram.org/CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequ… Critical Network Exploitable Fri, 25 Sep 2026 00:15:49 GMT https://vulnogram.org/CVE-2026-92288 https://vulnogram.org/CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party.… Critical Network Exploitable Fri, 25 Sep 2026 00:10:24 GMT https://vulnogram.org/CVE-2026-97230 https://vulnogram.org/CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a… Critical Network Exploitable Thu, 24 Sep 2026 22:36:50 GMT https://vulnogram.org/CVE-2026-85491 https://vulnogram.org/CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepare_action with a vers… High Thu, 24 Sep 2026 21:54:04 GMT https://vulnogram.org/CVE-2026-95831 https://vulnogram.org/CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code… High Tue, 22 Sep 2026 18:21:23 GMT https://vulnogram.org/CVE-2026-87082 https://vulnogram.org/CVE-2026-87082 Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed b… High Network Exploitable Tue, 22 Sep 2026 07:25:37 GMT