EUVD-2026-103196

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756

A flaw was found in Text::CSVXS. When printing records where a UTF-8 flagged field precedes invalid UTF-8 bytes, the module drops held-back bytes, closing quotes, and line endings without signaling an error. An attacker capable of providing crafted input can exploit this flaw to cause data...

PT-2026-116170

Name of the Vulnerable Software and Affected Versions Text::CSV XS versions prior to 1.65 Description An issue exists in the print function where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes. During buffer flushes, the system holds ba...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

CVE-2026-56852: Loop with Unreachable Exit Condition

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...

CVE-2026-42327: Improper Input Validation

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...