Priority MEDIUM 54
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.
RRWO
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
RRWO records in CISA KEVNo RRWO vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
20 records
Priority MEDIUM 48
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.
TI-2026-34943 CVE-2026-47372 · GHSA-h295-pfx3-r298
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts
Priority MEDIUM 47
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.
TI-2026-34345 CVE-2026-46720 · GHSA-vqfg-jwcg-58ww
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections
Priority MEDIUM 42
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
TI-2026-15909 CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set…
Priority MEDIUM 40
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
TI-2026-36790 CVE-2026-49941 · GHSA-wvxw-q92g-9ghf
Uncontrolled recursion in RRWO Net::CIDR::Set
Priority LOW 39
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
TI-2026-34944 CVE-2026-47373 · GHSA-mjc4-qqxc-7h36
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks
Priority LOW 39
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks.
Priority LOW 39
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.
TI-2026-36791 CVE-2026-49942 · GHSA-fff7-gx98-vr3g
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks
Priority LOW 38
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.
TI-2026-33001 CVE-2026-45180
Cleartext transmission of sensitive information in RRWO Catalyst::Plugin::Statsd
Priority LOW 38
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.
Priority LOW 38
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
TI-2026-08479 CVE-2026-9658 · GHSA-xcq6-chp9-g954
HTTP response splitting in RRWO Plack::Middleware::Security::Common
Priority LOW 37
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.
TI-2026-07726 CVE-2026-8788 · GHSA-57h4-p8xg-x38x
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections
Priority LOW 37
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
TI-2026-34344 CVE-2026-46719 · GHSA-2x39-j499-jv87
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections
Priority LOW 35
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
TI-2026-36789 CVE-2026-49940 · GHSA-hpv8-77xm-27wx
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks
Priority LOW 34
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.
TI-2025-02663 CVE-2025-3051 · GHSA-q2hm-mp4x-64qg
Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory
Priority LOW 31
Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.
TI-2026-33000 CVE-2026-45179
Cleartext transmission of sensitive information in RRWO Plack::Middleware::Statsd
Priority LOW 29
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.
TI-2025-27305 CVE-2025-40911 · GHSA-p745-hrr6-rg8c
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading…
Priority LOW 29
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.
TI-2026-34364 CVE-2026-46740 · GHSA-ffgx-7q59-grgc
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections
Priority LOW 24
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.
TI-2026-14328 CVE-2026-17435
Link following in RRWO File::Rotate::Simple
Priority LOW 12
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files.