TIMLEGGE XML::Sig

• CVE-2026-18568 High 7.5 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check 0.3%
• CVE-2026-9487 Critical 9.1 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID 0.3%
• CVE-2026-9390 Critical 9.1 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup 0.5%
• CVE-2025-40934 Critical 9.3 XML-Sig prior to 0.68 for Perl improperly validates XML without signatures 0.2%