MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1450:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1450:01 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : perl-YAML-Syck, --advisory ALAS2-2026-3837 (ALAS-2026-3837)

The version of perl-YAML-Syck installed on the remote host is prior to 1.27-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3837 advisory. YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still...

Security update for perl-YAML-Syck (important)

openSUSE Security Update: Security update for perl-YAML-Syck Announcement ID: openSUSE-SU-2026:0273-1 Rating: important References: 1265155 1271631 1271632 1271633 1271634 Cross-References: CVE-2025-11683 CVE-2026-13713 CVE-2026-5089 CVE-2026-57075 CVE-2026-57076 CVE-2026-57077 CVSS scores:...

MGASA-2026-0317 Updated perl packages fix security vulnerabilities

The updated Mageia 10 perl packages contain security fixes for CVE-2026-13221, CVE-2026-57432 and CVE-2026-57433. The Mageia 9 perl packages were not affected by CVE-2026-13221, they are now updated with fixes for CVE-2026-57432 and CVE-2026-57433...

Updated perl packages fix security vulnerabilities

The updated Mageia 10 perl packages contain security fixes for CVE-2026-13221, CVE-2026-57432 and CVE-2026-57433. The Mageia 9 perl packages were not affected by CVE-2026-13221, they are now updated with fixes for CVE-2026-57432 and CVE-2026-57433...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-57432

A flaw was found in Perl. An integer overflow vulnerability in the Smeasurestruct function, specifically when handling pack and unpack templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

EUVD-2026-52325

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-18092

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...

EUVD-2026-52291

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree. newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields...

CVE-2026-18092

Net::SAML2 for Perl is affected prior to version 0.86. The vulnerability arises because new_from_xml reads assertion identity (NameID, attributes, SessionIndex, etc.) using document-wide XPath (e.g., //saml:Assertion/saml:AttributeStatement/saml:Attribute, //saml:Subject/saml:NameID) instead of t...

CVE-2026-9487

CVE-2026-9487 affects XML::Sig for Perl up to version 0.70. The vulnerability arises because _get_signed_xml() resolves IDs with the XPath //*[@ID='$id'] and accepts two elements sharing the same ID, causing signature wrapping: the digest and signature are validated against the first element in d...

CVE-2026-9487 XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

CVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...