Timlegge vulnerabilities

Products

• Crypt::dsa 4
• Xml::sig 4
• Crypt\ 3
• Net\ 3
• Net::saml2 3
• Crypt::nacl::sodium 2

Newest

• timlegge xml::sig, xml\ \ +1 more XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check CVE-2026-18568 7.5 HighAugust 3, 2026
• timlegge net::saml2, net\ +1 more Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtre… CVE-2026-18092 8.1 HighAugust 3, 2026
• timlegge xml::sig, xml\ \ +1 more XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID CVE-2026-9487 9.1 CriticalAugust 3, 2026
• timlegge xml::sig, xml\ \ +1 more XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup CVE-2026-9390 9.1 CriticalAugust 3, 2026
• timlegge net::saml2, net\ +1 more Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature CVE-2026-18108 9.8 CriticalAugust 3, 2026
• timlegge net::saml2, net\ +1 more Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured CVE-2026-18089 7.5 HighAugust 3, 2026
• timlegge crypt::dsa Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery CVE-2026-14570 7.5 HighJuly 5, 2026
• timlegge crypt::dsa Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery CVE-2026-12205 9.1 CriticalJune 15, 2026
• timlegge crypt::dsa Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified CVE-2026-8704 6.5 MediumMay 15, 2026
• timlegge crypt::dsa Crypt::DSA versions before 1.20 for Perl generate seeds using rand CVE-2026-8700 7.3 HighMay 15, 2026
• timlegge crypt::nacl::sodium, crypt\ +1 more Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows CVE-2026-30909 9.8 CriticalMarch 8, 2026
• timlegge crypt::nacl::sodium, crypt\ +1 more Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems CVE-2026-2588 9.1 CriticalFebruary 22, 2026
• timlegge xml::sig, xml\ \ +1 more XML-Sig prior to 0.68 for Perl improperly validates XML without signatures CVE-2025-40934 Fix available 9.3 CriticalNovember 26, 2025
• perl crypt::random, timlegge crypt\ +1 more Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions CVE-2025-1828 8.8 HighMarch 10, 2025
• timlegge io::compress::brotli IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library CVE-2020-36846 9.8 CriticalSeptember 15, 2020