RLSA-2026:99212 Important: perl-CGI security update

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTM...

RLSA-2026:99215 Important: perl-CGI security update

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTM...

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

CVE-2026-127235 OpenNMS reflected cross-site scripting in the web UI via request parameters

A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs...

CVE-2026-127235

Multiple versions of OpenNMS Meridian and Horizon are vulnerable to a reflected cross-site scripting (XSS) flaw in the web user interface. The root cause is the failure to apply correct contextual output encoding when copying request parameter values into the HTML response. A remote attacker can ...

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

CVE-2022-34265

CVE-2022-34265 Vulnerability Summary This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookupname argument of...

CVE-2026-17232

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be...

CVE-2026-17232

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. These flaws arise from the improper neutralization of special elements in requests, where specially formed request parameters are not handled safely. This oversight could al...

CVE-2026-17232 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be...

CVE-2026-76646

A flaw was found in Apache MyFaces. A remote attacker could exploit this by sending specially crafted request parameters, leading to excessive resource consumption. This could potentially result in a denial of service DoS condition, making the affected system unavailable to legitimate users...

SUSE CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-120645

A flaw was found in perl-cgi. When rendering option groups using the scrollinglist function, user-supplied input from request parameters is directly inserted into regular expression search patterns without proper escaping. A remote attacker can exploit this vulnerability by submitting crafted inp...

DEBIAN-CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

UBUNTU-CVE-2026-120645

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist. When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters,...

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...