{"schema_version":1,"title":"CPAN vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 27 vulnerabilities in CPAN: 9 in the last 7 days and 12 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97230, was published on 24 September 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/cpan","json_url":"https://junglewise.ai/threats/vendors/cpan.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/cpan","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":5,"all_time":27,"critical":6,"exploited":0,"last_7_days":9,"last_30_days":10,"last_90_days":12,"last_365_days":27},"latest":[{"cve":"CVE-2026-97230","cvss":9.8,"epss":0.0012,"slug":"cve-2026-97230-io-socket-ssl-selfcertificate-versions-1-00-for-perl-contains","title":"IO::Socket::SSL::SelfCertificate malware code execution via obfuscated URL","severity":"critical","exploited":false,"published_at":"2026-09-24T23:19:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-97230-io-socket-ssl-selfcertificate-versions-1-00-for-perl-contains"},{"cve":"CVE-2026-95831","cvss":7.8,"epss":0.0012,"slug":"cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl","title":"Crypt::SelfCertificate malware in Perl module","severity":"high","exploited":false,"published_at":"2026-09-22T19:17:00.227+00:00","url":"https://junglewise.ai/threats/cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl"},{"cve":"CVE-2026-87081","cvss":7.5,"epss":0.0063,"slug":"cve-2026-87081-net-idn-uts46-versions-before-2-590-for-perl-allow-cpu-exhaustion","title":"Net::IDN::UTS46 CPU exhaustion via quadratic punycode encoding","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.863+00:00","url":"https://junglewise.ai/threats/cve-2026-87081-net-idn-uts46-versions-before-2-590-for-perl-allow-cpu-exhaustion"},{"cve":"CVE-2026-87080","cvss":9.1,"epss":0.0063,"slug":"cve-2026-87080-net-idn-punycode-pp-versions-before-2-590-for-perl-decode-a","title":"Net::IDN::Punycode::PP truncated label decoding vulnerability","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:40.75+00:00","url":"https://junglewise.ai/threats/cve-2026-87080-net-idn-punycode-pp-versions-before-2-590-for-perl-decode-a"},{"cve":"CVE-2026-87079","cvss":7.5,"epss":0.0063,"slug":"cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu","title":"Net::IDN::Punycode CPU exhaustion via quadratic insertion cost","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.637+00:00","url":"https://junglewise.ai/threats/cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu"},{"cve":"CVE-2026-87078","cvss":9.1,"epss":0.0065,"slug":"cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak","title":"Net::IDN::Punycode memory leak in decode_punycode","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:40.53+00:00","url":"https://junglewise.ai/threats/cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak"},{"cve":"CVE-2026-74766","cvss":8.4,"epss":0.0019,"slug":"cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow","title":"Net::IDN::Punycode heap use-after-free in decode_punycode","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.267+00:00","url":"https://junglewise.ai/threats/cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow"},{"cve":"CVE-2026-74765","cvss":6.5,"epss":0.0052,"slug":"cve-2026-74765-net-idn-punycode-versions-before-2-590-for-perl-allow-an-out-of","title":"Net::IDN::Punycode integer overflow in delta accumulator","severity":"medium","exploited":false,"published_at":"2026-09-22T08:16:40.143+00:00","url":"https://junglewise.ai/threats/cve-2026-74765-net-idn-punycode-versions-before-2-590-for-perl-allow-an-out-of"},{"cve":"CVE-2016-15059","cvss":9.8,"epss":0.0042,"slug":"cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap","title":"Net::IDN::Punycode heap buffer overflow in encode_punycode","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:34.52+00:00","url":"https://junglewise.ai/threats/cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap"},{"cve":"CVE-2026-82309","cvss":4.3,"epss":0.0037,"slug":"cve-2026-82309-robots-validate-unbounded-dns-queries-via-reverse-confirmation","title":"Robots::Validate unbounded DNS queries via reverse confirmation loop","severity":"medium","exploited":false,"published_at":"2026-09-04T13:20:10.667+00:00","url":"https://junglewise.ai/threats/cve-2026-82309-robots-validate-unbounded-dns-queries-via-reverse-confirmation"},{"cve":"CVE-2026-78183","cvss":9.8,"epss":0.0067,"slug":"cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float","title":"DBD::Pg heap out-of-bounds write in quote_float","severity":"critical","exploited":false,"published_at":"2026-08-23T20:16:50.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float"},{"cve":"CVE-2026-77781","cvss":7.5,"epss":0.0061,"slug":"cve-2026-77781-tie-hash-regex-denial-of-service-on-malformed-regex-keys","title":"Tie::Hash::Regex denial of service on malformed regex keys","severity":"high","exploited":false,"published_at":"2026-08-22T00:16:46.71+00:00","url":"https://junglewise.ai/threats/cve-2026-77781-tie-hash-regex-denial-of-service-on-malformed-regex-keys"},{"cve":"CVE-2026-11527","cvss":0,"slug":"cve-2026-11527-perl-config-inifiles-os-command-injection-in-make-filehandle","title":"Perl Config::IniFiles OS command injection in _make_filehandle","severity":"info","exploited":false,"published_at":"2026-06-14T12:16:23.357+00:00","url":"https://junglewise.ai/threats/cve-2026-11527-perl-config-inifiles-os-command-injection-in-make-filehandle"},{"cve":"CVE-2026-50639","cvss":0,"slug":"cve-2026-50639-perl-metrics-any-adapter-signalfx-metric-injection-via-crlf","title":"Perl Metrics::Any::Adapter::SignalFx metric injection via CRLF sequences","severity":"info","exploited":false,"published_at":"2026-06-10T19:16:37.483+00:00","url":"https://junglewise.ai/threats/cve-2026-50639-perl-metrics-any-adapter-signalfx-metric-injection-via-crlf"},{"cve":"CVE-2026-50638","cvss":5.3,"slug":"cve-2026-50638-perl-metrics-any-adapter-dogstatsd-metric-injection-vulnerability","title":"Perl Metrics::Any::Adapter::DogStatsd metric injection vulnerability","severity":"info","exploited":false,"published_at":"2026-06-10T19:16:37.38+00:00","url":"https://junglewise.ai/threats/cve-2026-50638-perl-metrics-any-adapter-dogstatsd-metric-injection-vulnerability"},{"cve":"CVE-2026-50637","cvss":5.3,"slug":"cve-2026-50637-perl-metrics-any-adapter-statsd-metric-injection-vulnerability","title":"Perl Metrics::Any::Adapter::Statsd metric injection vulnerability","severity":"info","exploited":false,"published_at":"2026-06-10T19:16:37.263+00:00","url":"https://junglewise.ai/threats/cve-2026-50637-perl-metrics-any-adapter-statsd-metric-injection-vulnerability"},{"cve":"CVE-2026-10725","cvss":0,"slug":"cve-2026-10725-perl-protocol-http2-denial-of-service-via-http-2-bomb","title":"Perl Protocol::HTTP2 denial of service via HTTP/2 Bomb","severity":"info","exploited":false,"published_at":"2026-06-06T10:16:25.79+00:00","url":"https://junglewise.ai/threats/cve-2026-10725-perl-protocol-http2-denial-of-service-via-http-2-bomb"},{"cve":"CVE-2026-49942","cvss":6.5,"slug":"cve-2026-49942-perl-net-cidr-set-improper-validation-of-network-masks","title":"Perl Net::CIDR::Set improper validation of network masks","severity":"info","exploited":false,"published_at":"2026-06-04T17:16:33.283+00:00","url":"https://junglewise.ai/threats/cve-2026-49942-perl-net-cidr-set-improper-validation-of-network-masks"},{"cve":"CVE-2026-49941","cvss":5.3,"slug":"cve-2026-49941-perl-net-cidr-set-denial-of-service-via-uncontrolled-recursion","title":"Perl Net::CIDR::Set denial of service via uncontrolled recursion","severity":"info","exploited":false,"published_at":"2026-06-04T17:16:33.173+00:00","url":"https://junglewise.ai/threats/cve-2026-49941-perl-net-cidr-set-denial-of-service-via-uncontrolled-recursion"},{"cve":"CVE-2026-8722","cvss":5.3,"slug":"cve-2026-8722-perl-net-async-statsd-client-metric-injection-via-crlf-sequences","title":"Perl Net::Async::Statsd::Client metric injection via CRLF sequences","severity":"info","exploited":false,"published_at":"2026-06-04T00:17:00.333+00:00","url":"https://junglewise.ai/threats/cve-2026-8722-perl-net-async-statsd-client-metric-injection-via-crlf-sequences"},{"cve":"CVE-2026-8594","cvss":0,"slug":"cve-2026-8594-text-linefold-resource-consumption-via-output-duplication","title":"Text::LineFold resource consumption via output duplication","severity":"info","exploited":false,"published_at":"2026-05-30T16:17:05.067+00:00","url":"https://junglewise.ai/threats/cve-2026-8594-text-linefold-resource-consumption-via-output-duplication"},{"cve":"CVE-2026-46473","cvss":5.3,"slug":"cve-2026-46473-perl-authen-totp-predictable-secret-generation-via-rand","title":"Perl Authen::TOTP predictable secret generation via rand","severity":"info","exploited":false,"published_at":"2026-05-21T19:16:53.51+00:00","url":"https://junglewise.ai/threats/cve-2026-46473-perl-authen-totp-predictable-secret-generation-via-rand"},{"cve":"CVE-2026-47372","cvss":0,"slug":"cve-2026-47372-perl-crypt-saltedhash-weak-prng-in-salt-generation","title":"Perl Crypt::SaltedHash weak PRNG in salt generation","severity":"info","exploited":false,"published_at":"2026-05-20T22:16:37.27+00:00","url":"https://junglewise.ai/threats/cve-2026-47372-perl-crypt-saltedhash-weak-prng-in-salt-generation"},{"cve":"CVE-2026-47373","cvss":0,"slug":"cve-2026-47373-perl-crypt-saltedhash-timing-attack-in-hash-validation","title":"Perl Crypt::SaltedHash timing attack in hash validation","severity":"info","exploited":false,"published_at":"2026-05-20T21:16:17.853+00:00","url":"https://junglewise.ai/threats/cve-2026-47373-perl-crypt-saltedhash-timing-attack-in-hash-validation"},{"cve":"CVE-2026-5089","cvss":0,"slug":"cve-2026-5089-yaml-syck-out-of-bounds-read-in-base60-parsing","title":"YAML::Syck out-of-bounds read in base60 parsing","severity":"info","exploited":false,"published_at":"2026-05-12T17:16:21.72+00:00","url":"https://junglewise.ai/threats/cve-2026-5089-yaml-syck-out-of-bounds-read-in-base60-parsing"}],"vendor":{"hub":true,"name":"CPAN","slug":"cpan","homepage":"https://www.cpan.org/","description":"The Comprehensive Perl Archive Network is a central repository for Perl software and documentation.","url":"https://junglewise.ai/threats/vendors/cpan"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":4,"exploited":0,"vulnerabilities":9}],"most_severe":[{"cve":"CVE-2026-78183","cvss":9.8,"epss":0.0067,"slug":"cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float","title":"DBD::Pg heap out-of-bounds write in quote_float","severity":"critical","exploited":false,"published_at":"2026-08-23T20:16:50.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float"},{"cve":"CVE-2006-10003","cvss":9.8,"epss":0.0051,"slug":"cve-2006-10003-cpan-xml-parser-heap-buffer-overflow-in-st-serial-stack","title":"CPAN XML::Parser heap buffer overflow in st_serial_stack","severity":"critical","exploited":false,"published_at":"2026-03-19T12:16:17.047+00:00","url":"https://junglewise.ai/threats/cve-2006-10003-cpan-xml-parser-heap-buffer-overflow-in-st-serial-stack"},{"cve":"CVE-2016-15059","cvss":9.8,"epss":0.0042,"slug":"cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap","title":"Net::IDN::Punycode heap buffer overflow in encode_punycode","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:34.52+00:00","url":"https://junglewise.ai/threats/cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap"},{"cve":"CVE-2026-97230","cvss":9.8,"epss":0.0012,"slug":"cve-2026-97230-io-socket-ssl-selfcertificate-versions-1-00-for-perl-contains","title":"IO::Socket::SSL::SelfCertificate malware code execution via obfuscated URL","severity":"critical","exploited":false,"published_at":"2026-09-24T23:19:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-97230-io-socket-ssl-selfcertificate-versions-1-00-for-perl-contains"},{"cve":"CVE-2026-87078","cvss":9.1,"epss":0.0065,"slug":"cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak","title":"Net::IDN::Punycode memory leak in decode_punycode","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:40.53+00:00","url":"https://junglewise.ai/threats/cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak"},{"cve":"CVE-2026-87080","cvss":9.1,"epss":0.0063,"slug":"cve-2026-87080-net-idn-punycode-pp-versions-before-2-590-for-perl-decode-a","title":"Net::IDN::Punycode::PP truncated label decoding vulnerability","severity":"critical","exploited":false,"published_at":"2026-09-22T08:16:40.75+00:00","url":"https://junglewise.ai/threats/cve-2026-87080-net-idn-punycode-pp-versions-before-2-590-for-perl-decode-a"},{"cve":"CVE-2026-74766","cvss":8.4,"epss":0.0019,"slug":"cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow","title":"Net::IDN::Punycode heap use-after-free in decode_punycode","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.267+00:00","url":"https://junglewise.ai/threats/cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow"},{"cve":"CVE-2026-95831","cvss":7.8,"epss":0.0012,"slug":"cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl","title":"Crypt::SelfCertificate malware in Perl module","severity":"high","exploited":false,"published_at":"2026-09-22T19:17:00.227+00:00","url":"https://junglewise.ai/threats/cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl"},{"cve":"CVE-2026-87081","cvss":7.5,"epss":0.0063,"slug":"cve-2026-87081-net-idn-uts46-versions-before-2-590-for-perl-allow-cpu-exhaustion","title":"Net::IDN::UTS46 CPU exhaustion via quadratic punycode encoding","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.863+00:00","url":"https://junglewise.ai/threats/cve-2026-87081-net-idn-uts46-versions-before-2-590-for-perl-allow-cpu-exhaustion"},{"cve":"CVE-2026-87079","cvss":7.5,"epss":0.0063,"slug":"cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu","title":"Net::IDN::Punycode CPU exhaustion via quadratic insertion cost","severity":"high","exploited":false,"published_at":"2026-09-22T08:16:40.637+00:00","url":"https://junglewise.ai/threats/cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"CPAN Net::CIDR::Lite","slug":"net-cidr-lite","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/net-cidr-lite"},{"name":"CPAN YAML-Syck","slug":"yaml-syck","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/yaml-syck"}]}