CVE-2026-18568 | High | 7.5 | 2026-08-03 | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cr… |
CVE-2026-9487 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the Sign… |
CVE-2026-9390 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate… |
CVE-2026-18108 | Critical | 9.8 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content… |
CVE-2026-18092 | High | 8.1 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with documen… |
CVE-2026-18089 | High | 7.5 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when n… |
CVE-2026-14570 | High | 7.5 | 2026-07-05 | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery.
"Crypt::D… |
CVE-2026-12205 | Critical | 9.1 | 2026-06-15 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.
Crypt::DSA::sign caches the per-signature nonce… |
CVE-2026-8704 | Medium | 6.5 | 2026-05-15 | Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified. |
CVE-2026-8700 | High | 7.3 | 2026-05-15 | Crypt::DSA versions before 1.20 for Perl generate seeds using rand.
Seeds were generated using Perl's built-in rand function, which is predictable and unsuita… |
CVE-2026-30909 | Critical | 9.8 | 2026-03-08 | Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows.
bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not che… |
CVE-2026-2588 | Critical | 9.1 | 2026-02-23 | Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.
Sodium.xs casts a STRLEN (size_t) to unsigned long long wh… |
CVE-2025-40934 | Critical | 9.3 | 2025-11-26 | XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML docum… |
CVE-2020-36846 | Critical | 9.8 | 2025-05-30 | A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of… |
CVE-2025-1828 | High | 8.8 | 2025-03-11 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.
If the Provider is n… |