{"schema_version":1,"title":"OETIKER CallBackery vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in OETIKER CallBackery: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118987, was published on 30 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/callbackery","json_url":"https://junglewise.ai/threats/technologies/callbackery.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/callbackery","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":10,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":10,"last_90_days":10,"last_365_days":10},"latest":[{"cve":"CVE-2026-118987","slug":"cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session","title":"CallBackery session cookie age validation bypass in X-Session-Cookie header","severity":"info","exploited":false,"published_at":"2026-10-30T14:16:41.67+00:00","url":"https://junglewise.ai/threats/cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session"},{"cve":"CVE-2026-118986","slug":"cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie","title":"CallBackery Perl session cookie forgery via weak random secret","severity":"info","exploited":false,"published_at":"2026-10-30T14:16:41.543+00:00","url":"https://junglewise.ai/threats/cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie"},{"cve":"CVE-2026-13576","slug":"cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords","title":"CallBackery unsalted HMAC-SHA1 password hashing","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.9+00:00","url":"https://junglewise.ai/threats/cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords"},{"cve":"CVE-2026-118995","slug":"cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended","title":"CallBackery regex pattern validation bypass in form fields","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.32+00:00","url":"https://junglewise.ai/threats/cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended"},{"cve":"CVE-2026-118994","slug":"cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection","title":"CallBackery log injection via newlines in login name","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.213+00:00","url":"https://junglewise.ai/threats/cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection"},{"cve":"CVE-2026-118993","slug":"cve-2026-118993-callbackery-versions-before-0-62-0-for-perl-allow-denial-of","title":"CallBackery denial of service via regex backtracking in request path","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.1+00:00","url":"https://junglewise.ai/threats/cve-2026-118993-callbackery-versions-before-0-62-0-for-perl-allow-denial-of"},{"cve":"CVE-2026-118992","slug":"cve-2026-118992-callbackery-versions-before-0-62-0-for-perl-allow-os-command","title":"CallBackery OS command execution via sqlite3 shell in backup restore","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.99+00:00","url":"https://junglewise.ai/threats/cve-2026-118992-callbackery-versions-before-0-62-0-for-perl-allow-os-command"},{"cve":"CVE-2026-118991","slug":"cve-2026-118991-callbackery-versions-before-0-62-0-for-perl-encrypt","title":"CallBackery weak encryption in configuration backups","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.88+00:00","url":"https://junglewise.ai/threats/cve-2026-118991-callbackery-versions-before-0-62-0-for-perl-encrypt"},{"cve":"CVE-2026-118990","slug":"cve-2026-118990-callbackery-versions-before-0-62-0-for-perl-leave-a-world","title":"CallBackery configuration database world-readable in /tmp","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.763+00:00","url":"https://junglewise.ai/threats/cve-2026-118990-callbackery-versions-before-0-62-0-for-perl-leave-a-world"},{"cve":"CVE-2026-118988","slug":"cve-2026-118988-callbackery-versions-before-0-60-1-for-perl-let-unauthenticated","title":"CallBackery path traversal in /doc route","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.647+00:00","url":"https://junglewise.ai/threats/cve-2026-118988-callbackery-versions-before-0-60-1-for-perl-let-unauthenticated"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":10},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"OETIKER CallBackery","slug":"callbackery","vendor":{"hub":true,"name":"OETIKER","slug":"oetiker","url":"https://junglewise.ai/threats/vendors/oetiker"},"aliases":[],"category":"backup-encryption-library","description":"Web application framework for backup and callback scheduling in Perl.","url":"https://junglewise.ai/threats/technologies/callbackery"},"most_severe":[{"cve":"CVE-2026-118987","slug":"cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session","title":"CallBackery session cookie age validation bypass in X-Session-Cookie header","severity":"info","exploited":false,"published_at":"2026-10-30T14:16:41.67+00:00","url":"https://junglewise.ai/threats/cve-2026-118987-callbackery-versions-before-0-62-0-for-perl-accept-session"},{"cve":"CVE-2026-118986","slug":"cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie","title":"CallBackery Perl session cookie forgery via weak random secret","severity":"info","exploited":false,"published_at":"2026-10-30T14:16:41.543+00:00","url":"https://junglewise.ai/threats/cve-2026-118986-callbackery-versions-before-0-62-0-for-perl-allow-session-cookie"},{"cve":"CVE-2026-13576","slug":"cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords","title":"CallBackery unsalted HMAC-SHA1 password hashing","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.9+00:00","url":"https://junglewise.ai/threats/cve-2026-13576-callbackery-versions-before-0-62-0-for-perl-store-user-passwords"},{"cve":"CVE-2026-118995","slug":"cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended","title":"CallBackery regex pattern validation bypass in form fields","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.32+00:00","url":"https://junglewise.ai/threats/cve-2026-118995-callbackery-versions-before-0-62-0-for-perl-accept-unintended"},{"cve":"CVE-2026-118994","slug":"cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection","title":"CallBackery log injection via newlines in login name","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.213+00:00","url":"https://junglewise.ai/threats/cve-2026-118994-callbackery-versions-before-0-62-0-for-perl-allow-log-injection"},{"cve":"CVE-2026-118993","slug":"cve-2026-118993-callbackery-versions-before-0-62-0-for-perl-allow-denial-of","title":"CallBackery denial of service via regex backtracking in request path","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:32.1+00:00","url":"https://junglewise.ai/threats/cve-2026-118993-callbackery-versions-before-0-62-0-for-perl-allow-denial-of"},{"cve":"CVE-2026-118992","slug":"cve-2026-118992-callbackery-versions-before-0-62-0-for-perl-allow-os-command","title":"CallBackery OS command execution via sqlite3 shell in backup restore","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.99+00:00","url":"https://junglewise.ai/threats/cve-2026-118992-callbackery-versions-before-0-62-0-for-perl-allow-os-command"},{"cve":"CVE-2026-118991","slug":"cve-2026-118991-callbackery-versions-before-0-62-0-for-perl-encrypt","title":"CallBackery weak encryption in configuration backups","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.88+00:00","url":"https://junglewise.ai/threats/cve-2026-118991-callbackery-versions-before-0-62-0-for-perl-encrypt"},{"cve":"CVE-2026-118990","slug":"cve-2026-118990-callbackery-versions-before-0-62-0-for-perl-leave-a-world","title":"CallBackery configuration database world-readable in /tmp","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.763+00:00","url":"https://junglewise.ai/threats/cve-2026-118990-callbackery-versions-before-0-62-0-for-perl-leave-a-world"},{"cve":"CVE-2026-118988","slug":"cve-2026-118988-callbackery-versions-before-0-60-1-for-perl-let-unauthenticated","title":"CallBackery path traversal in /doc route","severity":"info","exploited":false,"published_at":"2026-10-30T13:18:31.647+00:00","url":"https://junglewise.ai/threats/cve-2026-118988-callbackery-versions-before-0-60-1-for-perl-let-unauthenticated"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}