These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-110759 is a critical vulnerability in Text::CSV_XS versions before 1.65 for Perl. The vulnerability occurs when the input to parse ends in a separator and a lone CR, causing the parser to treat the end of the input as the next character and store the end-of-file marker in the field as the byte 0xFF. This can lead to a malformed UTF-8 string being returned. The vulnerability has a CVSS score of 9. [truncated]
CVE-2026-110758 is a high-severity vulnerability in Text::CSV_XS versions before 1.65 for Perl. The vulnerability occurs when reading before the start of an all-blank field under allow_whitespace in strip_trail_whitespace, potentially leading to information disclosure. This issue arises because strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start o [truncated]
CVE-2026-110757 is a critical vulnerability in Text::CSV_XS versions before 1.65 for Perl, allowing record splitting by writing strings used as numbers without quotes in combine. This issue arises because combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. As a result, a value validated as a number can end the record early and turn the fields [truncated]
CVE-2026-110756 is a critical vulnerability in Text::CSV_XS versions before 1.65 for Perl. The vulnerability occurs when a UTF-8 flagged field precedes invalid UTF-8 bytes in print, causing the end of a record and its line ending to be dropped. This issue can lead to data corruption or manipulation in affected systems and applications. Defenders should assess exposure and prioritize verification and upgra [truncated]
CVE-2026-110754 is a medium-severity vulnerability in Text::CSV_XS versions before 1.65 for Perl, which causes a memory leak when parsing untrusted CSV data. The vulnerability occurs when the getline function fails to parse a record due to a syntax error, resulting in a memory leak. This can lead to memory exhaustion if the process is long-running and receives repeated malformed input.
CVE-2026-110753 is a critical vulnerability in Text::CSV_XS versions from 1.46 before 1.65 for Perl, involving a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. This issue can lead to a crash when the application still references the freed memory. The vulnerability has a CVSS score of 9.8, indicating a high severity level. Defenders should verify their version [truncated]
CVE-2026-110752 is a high-severity vulnerability in Text::CSV_XS, a Perl module for parsing CSV files. The vulnerability allows for memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. This can cause an application to exhaust memory, resulting in an Out of memory error. The vulnerability has a CVSS score of 7.5 and is classified as HIGH.
DBI::SQL::Nano, a mini-SQL engine for DBI, incorrectly evaluated WHERE predicates in some cases, inverting <= and >= SQL operators. This impacts applications using DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) when SQL::Statement is not installed or DBI_SQL_NANO=1 is set. The impact depends on the context, particularly where an application relies on a WHERE clause to filter file-backe [truncated]
CVE-2026-14740 is a vulnerability in DBI versions before 1.650 for Perl. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. This can cause a fault on memory-hardened builds and nondeterministic newline retention on normal builds. Users of DBI versions before 1.650 for Per [truncated]
A heap overflow vulnerability exists in DBI versions before 1.650 for Perl. This issue arises when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate sufficient memory to handle approximately 1.2 million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders. This vulnerability could potentially allow attackers to execute arbitra [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T23:16:53.963Z and has not been modified since then. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package, and arguments, and interpolates the package part [truncated]
A critical vulnerability was discovered in DBI versions before 1.648 for Perl. The issue arises from error messages being written to a 200-byte buffer without a length limit when RaiseError, PrintError, or HandleError are set. This allows attackers who can influence error text in an application to trigger a buffer overflow.
A critical vulnerability was discovered in DBI versions before 1.648 for Perl, which can lead to a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cete [truncated]
CVE-2026-7111 is a high-severity vulnerability in Text::CSV_XS, a Perl module for parsing and generating CSV data. The vulnerability allows for use-after-free, which may enable type confusion or memory corruption. This occurs when registered callbacks extend the Perl argument stack, causing a reallocation that invalidates the cached stack pointer. As a result, the return value is written to the freed buff [truncated]
