Priority MEDIUM 40
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-08-12 · Fixed in 0.23 CWE-1284
Priority LOW 12
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files.
CVSS 3.1LOW 2.5· Local · Low privileges · No interaction · EPSS 0.0014 · Published 2026-08-07 · Fixed in 0.4.0 CWE-59
Priority LOW 38
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00204 · Published 2026-08-01 · Fixed in 0.010 CWE-319
Priority MEDIUM 48
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00538 · Published 2026-07-27 · Fixed in 0.3.0 CWE-918
Priority MEDIUM 54
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02574 · Published 2026-07-25 · Fixed in 0.6.1 CWE-78
Priority LOW 38
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.003 · Published 2026-06-04 · No fix listed CWE-1289
Priority LOW 39
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00329 · Published 2026-06-04 · No fix listed CWE-1287
Priority LOW 34
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00196 · Published 2026-06-04 · No fix listed CWE-1289
Priority LOW 37
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00226 · Published 2026-05-28 · Fixed in 0.13.1 CWE-113
Priority LOW 24
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00326 · Published 2026-05-26 · No fix listed CWE-150
Priority MEDIUM 47
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00397 · Published 2026-05-20 · No fix listed CWE-338
Priority LOW 39
Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00393 · Published 2026-05-20 · No fix listed CWE-208
Priority LOW 37
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00226 · Published 2026-05-18 · No fix listed CWE-150
Priority MEDIUM 42
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00344 · Published 2026-05-17 · Fixed in 0.3.8 CWE-150
Priority LOW 35
Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00306 · Published 2026-05-16 · Fixed in 0.9.0 CWE-150
Priority LOW 38
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00244 · Published 2026-05-10 · No fix listed CWE-319
Priority LOW 29
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00219 · Published 2026-05-10 · Fixed in 0.9.0 CWE-319
Priority LOW 39
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-04-27 · Fixed in 0.7.8 CWE-122
Priority LOW 29
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00379 · Published 2025-05-27 · No fix listed CWE-1287
Priority LOW 31
Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00428 · Published 2025-04-01 · Fixed in 0.0701 CWE-427
THREATIST.IORead the docs