CVE Watch14 de nov. de 2026

CVE-2015-10149

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 14 de nov. de 2026 · Última mod.: 14 de nov. de 2026 · CWE-1286

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session. A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1251094.8 MÉD

13.0%

——4Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.2d CVE-2026-1235727.5 ALT

28.3%

——8Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes.2d CVE-2026-481797.5 ALT

18.2%

——5In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service5d CVE-2026-339587.5 ALT

25.8%

——8Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.5d CVE-2026-205956.7 MÉD

1.5%

——0In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.2d CVE-2026-111107—

29.7%

——9A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.10d