CVE-2026-120646

The CGI module for Perl (versions 4.71 through 4.99) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the uploadInfo function, which fails to verify that its argument is a valid upload filehandle before calling the filename method. An attacker can provide a crafted request ...

CVE-2026-120646 CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global...

EUVD-2026-114897

Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback rea...