Latest vulnerabilities for vendor "cpan"

Where

Sort:

Software

cpan batch

cpan cpan.pm

cpan data::entropy

cpan data::hashmap::shared

cpan file

cpan gd

cpan gd::securityimage

cpan imager

cpan net::dns

cpan net::saml2 (perl)

cpan parallel

cpan perl xml::sig

cpan perl-xml-libxml

cpan plack::app::prerender

cpan plack::middleware::oauth

cpan ui\

cpan www form

cpan yaml::syck

CPAN Net::SAML2 (Perl)Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree

Risk 59

Severity

8.1

First published (updated )

CVE-2026-18092

CPAN Perl XML::SigXML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

Risk 66

Severity

9.1

First published (updated )

CVE-2026-9487

CPAN Data::EntropyData::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

Risk 43

Severity

7.5

First published (updated )

CVE-2026-18536

CPAN Plack::App::PrerenderPlack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Risk 70

Severity

9.1

First published (updated )

CVE-2026-17552

CPAN Data::HashMap::SharedData::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy

Risk 66

Severity

9.1

First published (updated )

CVE-2026-59142

CPAN Net::DNSNet::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

Risk 46

Severity

7.5

First published (updated )

CVE-2026-64194

CPAN GD::SecurityImageGD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

Risk 28

Severity

5.3

First published (updated )

CVE-2026-13082

oss-secCVE-2026-57075: YAML::Syck versions befo1.47 for Perl allow an out-of-bounds ad via a signed-char lookup-table index in syck_base64dec

First published (updated )

https://seclists.org/oss-sec/2026/q3/159

CPAN perl-XML-LibXMLImportant: perl-XML-LibXML security update

Risk 26

First published (updated )

Advisory

RHSA-2026:39878

CPAN ImagerImager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol

Risk 46

Severity

7.5

First published (updated )

CVE-2026-13708

CPAN Plack::Middleware::OAuthPlack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter

Risk 62

Severity

8.1

First published (updated )

CVE-2026-12740

CPAN GDGD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

Risk 91

Severity

9.8

First published (updated )

CVE-2026-11526

CVE-2025-40928: JSON::XS befoversion 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified

First published (updated )

https://seclists.org/oss-sec/2025/q3/155

CPAN CGI::SimpleCGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw

Risk 51

Severity

7.3

First published (updated )

CVE-2025-40927

CVE-2011-10007: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `gp()` encounters a crafted file name

First published (updated )

https://seclists.org/oss-sec/2025/q2/216

CPAN Crypt::CBCCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

Risk 21

Severity

First published (updated )

CVE-2025-2814

CVE-2023-7101: Spreadsheet::ParseExcel for Perl is vulnerable to arbitrary code execution

First published (updated )

https://seclists.org/oss-sec/2023/q4/350

CPAN CPAN.pmCPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Risk 19

Severity

First published (updated )

REDHAT-BUG-2218667

Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

First published (updated )

https://seclists.org/oss-sec/2023/q2/128

CPAN Parallel\Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.

Risk 43

Severity

7.5

First published (updated )

CVE-2011-4115

CPAN File\_is_safe in the File::Temp module for Perl does not properly handle symlinks.

Risk 43

Severity

7.5

First published (updated )

CVE-2011-4116

CPAN Batch\The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.

Risk 43

Severity

7.5

First published (updated )

CVE-2011-4117

CPAN Safe.pmSafe.pm 2.26 and earlier (except 2.20 through 2.23 if using a threads-enabled Perl), when used in P…

Risk 19

Severity

First published (updated )

REDHAT-BUG-588269

CPAN Safe.pmSafe.pm 2.24 and earlier, when used in Perl 5.10.0 and earlier, may allow attackers to break out of …

Risk 19

Severity

First published (updated )

REDHAT-BUG-576508

CPAN Ui\Command Injection

Risk 86

Severity

9.8

First published (updated )

CVE-2008-7315

CPAN Www FormXSS

Risk 22

Severity

4.3

First published (updated )

CVE-2004-2332

Trending

Vendor Risk Score

Software

CPAN Net::SAML2 (Perl)Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree

CPAN Perl XML::SigXML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

CPAN Data::EntropyData::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

CPAN Plack::App::PrerenderPlack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

CPAN Data::HashMap::SharedData::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy

Don't miss critical vulnerabilities

CPAN Net::DNSNet::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

CPAN GD::SecurityImageGD::SecurityImage versions through 1.75 for Perl use rand to generate secrets

oss-secCVE-2026-57075: YAML::Syck versions befo1.47 for Perl allow an out-of-bounds ad via a signed-char lookup-table index in syck_base64dec

CPAN perl-XML-LibXMLImportant: perl-XML-LibXML security update

CPAN ImagerImager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol

Don't miss critical vulnerabilities

CPAN Plack::Middleware::OAuthPlack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter

CPAN GDGD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

CVE-2025-40928: JSON::XS befoversion 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified

CPAN CGI::SimpleCGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw

CVE-2011-10007: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `gp()` encounters a crafted file name

Don't miss critical vulnerabilities

CPAN Crypt::CBCCrypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions

CVE-2023-7101: Spreadsheet::ParseExcel for Perl is vulnerable to arbitrary code execution

CPAN CPAN.pmCPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

CPAN Parallel\Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.

Don't miss critical vulnerabilities

CPAN File\_is_safe in the File::Temp module for Perl does not properly handle symlinks.

CPAN Batch\The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.

CPAN Safe.pmSafe.pm 2.26 and earlier (except 2.20 through 2.23 if using a threads-enabled Perl), when used in P…

CPAN Safe.pmSafe.pm 2.24 and earlier, when used in Perl 5.10.0 and earlier, may allow attackers to break out of …

CPAN Ui\Command Injection

Don't miss critical vulnerabilities

CPAN Www FormXSS

Company

Resources

Contact