TI
Vendor
TIMLEGGE
15
CVEs
0
On KEV
0
New 30D
Products
CR9.1
Crypt::DSA
TIMLEGGE
4 CVEs0 on KEV0 new
XM9.3
XML::Sig
TIMLEGGE
4 CVEs0 on KEV0 new
NE9.8
Net::SAML2
TIMLEGGE
3 CVEs0 on KEV0 new
CR9.8
Crypt::NaCl::Sodium
TIMLEGGE
2 CVEs0 on KEV0 new
CR8.8
Crypt::random
Timlegge
1 CVEs0 on KEV0 new
IO9.8
IO::Compress::Brotli
TIMLEGGE
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-18568 | XM XML::Sig TIMLEGGE | 7.5 | Aug 3 | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check |
| CVE-2026-18092 | NE Net::SAML2 TIMLEGGE | 8.1 | Aug 3 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree |
| CVE-2026-9487 | XM XML::Sig TIMLEGGE | 9.1 | Aug 3 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID |
| CVE-2026-9390 | XM XML::Sig TIMLEGGE | 9.1 | Aug 3 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup |
| CVE-2026-18108 | NE Net::SAML2 TIMLEGGE | 9.8 | Aug 3 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature |
| CVE-2026-18089 | NE Net::SAML2 TIMLEGGE | 7.5 | Aug 3 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured |
| CVE-2026-14570 | CR Crypt::DSA TIMLEGGE | 7.5 | Jul 5 | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery |
| CVE-2026-12205 | CR Crypt::DSA TIMLEGGE | 9.1 | Jun 15 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery |
| CVE-2026-8704 | CR Crypt::DSA TIMLEGGE | 6.5 | May 15 | Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified |
| CVE-2026-8700 | CR Crypt::DSA TIMLEGGE | 7.3 | May 15 | Crypt::DSA versions before 1.20 for Perl generate seeds using rand |
| CVE-2026-30909 | CR Crypt::NaCl::Sodium TIMLEGGE | 9.8 | Mar 8 | Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows |
| CVE-2026-2588 | CR Crypt::NaCl::Sodium TIMLEGGE | 9.1 | Feb 22 | Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems |
| CVE-2025-40934 | XM XML::Sig TIMLEGGE | 9.3 | Nov 26 | XML-Sig prior to 0.68 for Perl improperly validates XML without signatures |
| CVE-2020-36846 | IO IO::Compress::Brotli TIMLEGGE | 9.8 | May 30 | IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library |
| CVE-2025-1828 | CR Crypt::random Timlegge | 8.8 | Mar 10 | Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions |