TIMLEGGE vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202612

Newest CVEs

• CVE-2026-18568

  XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

  TIMLEGGE · XML::Sig

  High7.5
• CVE-2026-18092

  Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree

  TIMLEGGE · Net::SAML2

  High8.1
• CVE-2026-9487

  XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

  TIMLEGGE · XML::Sig

  Critical9.1
• CVE-2026-9390

  XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

  TIMLEGGE · XML::Sig

  Critical9.1
• CVE-2026-18108

  Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

  TIMLEGGE · Net::SAML2

  Critical9.8
• CVE-2026-18089

  Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured

  TIMLEGGE · Net::SAML2

  High7.5
• CVE-2026-14570

  Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery

  TIMLEGGE · Crypt::DSA

  High7.5
• CVE-2026-12205

  Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery

  TIMLEGGE · Crypt::DSA

  Critical9.1
• CVE-2026-8704

  Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified

  TIMLEGGE · Crypt::DSA

  Medium6.5
• CVE-2026-8700

  Crypt::DSA versions before 1.20 for Perl generate seeds using rand

  TIMLEGGE · Crypt::DSA

  High7.3