Vulnerabilities

TI-2026-06484 CVE-2026-7381 · GHSA-j2f5-52cv-9wrh

Information disclosure in MIYAGAWA Plack::Middleware::XSendfile

MEDIUM 48

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00442 Published 2026-04-29 No fix listed CWE-200

TI-2026-29301 CVE-2026-40560 · GHSA-gwjf-hg8j-jwvr

LOW 39

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00487 Published 2026-04-28 Fixed in 0.4018 CWE-444

TI-2014-08412 CVE-2014-125112 · GHSA-58qr-v987-vh6w

MEDIUM 50

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00845 Published 2026-03-26 No fix listed CWE-565

TI-2013-06174 CVE-2013-10031 · GHSA-rvh4-4hm5-gx4x

LOW 39

Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacks

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00291 Published 2025-12-09 Fixed in 0.17 CWE-1254

TI-2025-27314 CVE-2025-40923 · GHSA-868p-jhqw-wrgr

LOW 32

Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurely.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0039 Published 2025-07-16 Fixed in 0.35 CWE-338