EUVD-2026-107580

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

unicorn-bios

unicorn-bios About Basic BIOS emulator/debugger for Unicorn Engine. Written to debug the XEOS Operating System boot sequence. Usage: Usage: unicorn-bios OPTIONS BOOTIMG Options: --help / -h: Displays help. --memory / -m: The amount of memory to allocate for the virtual machine in megabytes...

XSLeaker

XSLeaker XSLeaker is a tool that helps to find XS-Leaks on websites. The tool compares resource values for that a leak technique is known e.g. number of iframes between different states. XSLeaker consists of two components, a chrome extension that is used to gather the resource values in differen...

CVE-2026-112921

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its...

CVE-2026-112921

The Robots::Validate Perl module (versions 0.4.3 through 0.4.10) is vulnerable to a state-carryover issue in its Aho-Corasick search machine . Because the machine's state is not reset between requests, a User-Agent ending mid-match can cause a subsequent request to complete that match. This allow...

CVE-2026-110673

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, the "" character starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against maxdepth. A maliciously...

USN-8940-1 libxs-parse-keyword-perl vulnerability

It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service...

USN-8940-1: Perl XS::Parse::Keyword module vulnerability

It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service...

CVE-2026-110687

A flaw was found in perl-Cpanel-JSON-XS. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that...

CVE-2026-110686

A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is stil...

CVE-2026-110688

A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incrparse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this,...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...

CVE-2026-110682

A flaw was found in perl-Cpanel-JSON-XS. The allownonref configuration is enabled by default, and the incrparse function inherits it. Because a top-level number, boolean true or false, or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of...

CVE-2026-110684

A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allowstringify, convertblessed or allowbignum, the encodestringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting...

CVE-2026-110680

A flaw was found in perl-Cpanel-JSON-XS. When the canonical configuration is enabled, the keys of a tied or threads::shared hash are counted in a first pass before a second pass collects them for sorting. The encoder allocates a fixed 64-entry stack array or, for larger counts, a heap array sized...

CVE-2026-110675

A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...

CVE-2026-110685

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies throws an exception, the...

CVE-2026-110677

A flaw was found in perl-Cpanel-JSON-XS. When the dupkeysasarrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array...

CVE-2026-110676

A flaw was found in perl-Cpanel-JSON-XS. When the allowbignum configuration is enabled, a JSON number with a fraction or exponent decodes to a Math::BigFloat object, which stores the exponent separately and decodes efficiently. However, encoding this object untyped or as JSONTYPEFLOAT writes the...