TI-2026-08239 CVE-2026-9390 · GHSA-mhmm-7px6-jx3j
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
Priority MEDIUM 48
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
Xml
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Xml records in CISA KEVNo Xml vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2026-08334 CVE-2026-9487 · GHSA-wqp7-2ww4-q6mf
Improper signature verification in TIMLEGGE XML::Sig
Priority MEDIUM 47
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
TI-2025-27325 CVE-2025-40934 · GHSA-v825-mc9m-64qr
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
Priority MEDIUM 45
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
TI-2026-15218 CVE-2026-18568 · GHSA-r3hj-rg3j-262c
Improper signature verification in TIMLEGGE XML::Sig
Priority LOW 39
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check.
TI-2012-01008 CVE-2012-1102 · GHSA-cwv6-3m5x-7f9p
XML external entity injection in perl-xml-atom
Priority LOW 36
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources.