Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Sep 21, 2026Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler.CVE-2026-93712 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array.CVE-2026-93711 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks.CVE-2026-93710 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler.CVE-2026-93709 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_resCVE-2026-15689 · Other software · ABEVERLEY · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Both default emails emit a link of the form `$base/login/$code`, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: it stores a fresh reset code against that account and mails the account holder a link to a host of the sender's choosing. The welcome mail takes the same path when the application calls create_user with email_welcome set. Through 0.711 the handlers read `request->uri_base` and `request->base` directly; Versions 0.712 and later provide an uri_base configuration key that defaults to the untrusted `request->uri_base` when unset. The default configuration with reset_password_handler enabled and the default message text, a recipient who follows the link hands a working reset code to the sender's host, which is enough to take over the account.
- Product
- Dancer2::Plugin::Auth::Extensible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Jul 20, 2026Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable.CVE-2026-13577 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.2
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.CVE-2026-13410 · Other software · GARU · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.2
Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.
- Product
- Dancer::Plugin::Auth::Google
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter.CVE-2026-12746 · Other software · BIAFRA · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.1
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request this session initiated. Any application that uses this plugin for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim's session to complete the attacker's authorization and associating the attacker's provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim's account through their own provider credentials.
- Product
- Dancer2::Plugin::Auth::OAuth::Provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
Jun 15, 2026Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.CVE-2026-11832 · Other software · BIAFRA · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
- Product
- Dancer2::Plugin::Auth::OAuth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgdatatracker.ietf.org
Apr 30, 2026Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.CVE-2026-5080 · Other software · BIGPRESH · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.9
Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand() function to return a number between 0 and 999-billion, and concatenating that result three times. The path name might be known or guessed by an attacker, especially for applications known to be written using Dancer with standard installation locations. The epoch time can be guessed by an attacker, and may be leaked in the HTTP header. The process id comes from a small set of numbers, and workers may have sequential process ids. The built-in rand() function is seeded with 32-bits and is considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems.
- Product
- Dancer::Session::Abstract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgsecurity.metacpan.org
Jul 17, 2019Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control.CVE-2019-1010084 · Other software · Dancer::Plugin::SimpleCRUD · reported by josh@bress.netMedium 6.5
Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.
- Product
- Dancer::Plugin::SimpleCRUD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2018lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.CVE-2018-7652 · Other software · Zonemaster · reported by MITREMedium 6.1
lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
- Product
- Zonemaster Web GUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2014CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and coCVE-2012-5572 · Other software · Dancer · reported by Red HatMedium 5
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
- Product
- Dancer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.mageia.orgmandriva.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.