Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Jul 14, 2026Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.CVE-2026-15747 · Other software · SRI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Jun 23, 2026Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter.CVE-2026-9733 · Other software · HAYAJO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an attacker to hijack another user's session through cross site request forgery (CSRF).
- Product
- Mojolicious::Plugin::Web::Auth::OAuth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgmetacpan.org
Jun 18, 2026Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely.CVE-2026-9692 · Other software · HAYAJO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy sources that are unsuitable for security purposes.
- Product
- Mojolicious::Sessions::Storable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgsecurity.metacpan.org
May 26, 2026Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections.CVE-2026-46740 · Other software · RRWO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Version 0.06 changes the module from being a statsd client to using a separate statsd client. It defaults to using a version of Net::Statsd::Tiny that fixes a similar issue (CVE-2026-46720).
- Product
- Mojolicious::Plugin::Statsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Jun 16, 2025Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.CVE-2025-40916 · Other software · GRYPHON · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
- Product
- Mojolicious::Plugin::CaptchaPNG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Jun 11, 2025Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.CVE-2025-40915 · Other software · GRYPHON · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7
Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.
- Product
- Mojolicious::Plugin::CSRF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
May 3, 2025Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.CVE-2024-58134 · Other software · SRI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 8.1
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.mojolicious.orggithub.com
May 3, 2025Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default.CVE-2024-58135 · Other software · SRI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2024The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.CVE-2021-47208 · Other software · mojolicious · reported by MITREMedium 4.3
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
- Product
- mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2024The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string.CVE-2020-36829 · Other software · mojolicious · reported by MITREHigh 7.5
The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
- Product
- mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2024The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain.CVE-2018-25100 · Other software · mojolicious · reported by MITREMedium 5.3
The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar.
- Product
- mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2011Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unsCVE-2011-1841 · Other software · Mojolicious · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcpansearch.perl.orglists.fedoraproject.org
May 2, 2011Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.CVE-2010-4803 · Other software · Mojolicious · reported by MITREHigh 10
Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgcpansearch.perl.org
May 2, 2011Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.CVE-2010-4802 · Other software · Mojolicious · reported by MITREHigh 10
Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgcpansearch.perl.org
May 2, 2011Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.CVE-2009-5074 · Other software · Mojolicious · reported by MITREHigh 10
Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcpansearch.perl.orgcpansearch.perl.org
Apr 29, 2011Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slCVE-2011-1589 · Other software · Mojolicious · reported by Red HatMedium 5
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
- Product
- Mojolicious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgcpansearch.perl.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.