TTIMLEGGE

Products

Exploited and recent CVEs

• CVE-2026-18568 High 7.5 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check 0.3%
• CVE-2026-18092 High 8.1 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree 0.3%
• CVE-2026-9487 Critical 9.1 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID 0.3%
• CVE-2026-9390 Critical 9.1 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup 0.5%
• CVE-2026-18108 Critical 9.8 Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature 0.3%
• CVE-2026-18089 High 7.5 Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured 0.2%
• CVE-2026-14570 High 7.5 Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery 0.5%
• CVE-2026-12205 Critical 9.1 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery 0.3%
• CVE-2026-8704 Medium 6.5 Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified 0.3%
• CVE-2026-8700 High 7.3 Crypt::DSA versions before 1.20 for Perl generate seeds using rand 0.4%
• CVE-2026-30909 Critical 9.8 Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows 0.6%
• CVE-2026-2588 Critical 9.1 Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems 0.4%
• CVE-2025-40934 Critical 9.3 XML-Sig prior to 0.68 for Perl improperly validates XML without signatures 0.2%
• CVE-2020-36846 Critical 9.8 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library 0.7%