Amazon Linux 2 : perl-YAML (ALAS-2026-4035)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory. YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A...

CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

EUVD-2026-103450

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

CVE-2026-78497

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a "qr'...'" literal and compiled as source text, so a "? ... " code block in i...

CVE-2026-78497: Improper Neutralization of Directives in Dynamically Evaluated Code

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

PT-2026-116626

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...

needrestart-privesc-cve-2024-48990

needrestart Privilege Escalation CVE-2024-48990 This repository contains a minimal local privilege escalation exploit targeting a vulnerability in needrestart CVE-2024-48990. The vulnerability allows arbitrary Perl code execution as root by abusing the -c configuration option, which is parsed and...

DEBIAN-CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

PT-2026-104733

Name of the Vulnerable Software and Affected Versions YAML versions prior to 1.27 001 Description Loading a perl/glob document allows the replacement of any package variable, potentially leading to arbitrary code execution. A perl/glob document specifies a package and a symbol to assign a value...

CVE-2019-25777: Improper Control of Dynamically-Identified Variables

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

AlmaLinux 9.6 [TuxCare] Security Update: perl-DBI Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786121082)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786121082 advisory. - DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

EUVD-2026-82993

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

CVE-2026-75031: Improper Control of Generation of Code

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

PT-2026-95454

Name of the Vulnerable Software and Affected Versions interchange affected versions not specified Description A remote code execution issue exists in the “quick question” admin feature. Unauthenticated users can inject and execute arbitrary Perl code server-side. By default, this code runs within...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

SUSE CVE-2026-14380

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package...

UBUNTU-CVE-2026-14380

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package...

CVE-2026-14380

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package...