These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T16:16:28.560Z and has not been modified since then. The XML::Sig library for Perl, versions from 0.29 before 0.72, contains a signature verification bypass vulnerability. This vulnerability allows an attacker to bypass signature verification, potentially leading to security issues. The vulnerabil [truncated]
The XML::Sig library for Perl, versions before 0.71, is vulnerable to signature wrapping attacks due to its handling of duplicate IDs in XML documents. This vulnerability allows an attacker to supply a second element with the same ID, which can be read by applications resolving the ID independently, potentially allowing for the manipulation of SAML2 assertions. Affected product deployments exist in manage [truncated]
XML::Sig versions before 0.71 for Perl are vulnerable to XPath injection attacks due to improper handling of SignedInfo/Reference/@URI values. This critical vulnerability allows crafted URIs to inject arbitrary XPath operators, potentially leading to unauthorized element selection for digest verification. Organizations and developers using XML::Sig versions before 0.71 for Perl should be aware of this vul [truncated]
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. The vulnerability arises from the method's logic, which decrypts the EncryptedAssertion and returns it as verified when it carries no signature. This allows any party to encrypt an unsigned assertion to the service provider's e [truncated]
The CVE-2026-18092 vulnerability affects Net::SAML2 versions before 0.86 for Perl, allowing SAML authentication bypass via XML signature wrapping. This vulnerability has a high impact on systems using this library for SAML authentication. The CVE record was published on 2026-08-03T14:16:25.030Z and has not been modified since then. Affected parties should review and apply patches or mitigations to prevent [truncated]
Net::SAML2 versions before 0.86 for Perl are vulnerable to SAML authentication bypass. The vulnerability arises from the verify_xml function verifying responses against the response-embedded certificate when no trust anchor is configured. This allows an attacker to generate a response signed by an attacker-generated key whose self-signed certificate is embedded in that response, authenticating an arbitrar [truncated]
A vulnerability was discovered in Crypt::DSA versions before 1.21 for Perl, where the nonce was reused across signatures, allowing for private-key recovery. This is due to the caching of per-signature nonce material in the Key object without clearing it. As a result, keys used to sign more than once with an affected version should be considered compromised.
Crypt::DSA versions through 1.19 for Perl use a two-argument form of the open() function, which can allow existing files to be modified when the module handles DSA key files. The two-argument open is susceptible to shell metacharacter injection in the filename argument, potentially enabling an attacker to redirect output to arbitrary files or modify existing files if untrusted input is passed as a filenam [truncated]
Crypt::DSA versions before 1.20 for Perl generate cryptographic seeds using Perl's built-in `rand` function, which is not cryptographically secure. This weakness allows attackers who can observe or predict the seed values to potentially compromise DSA key generation, leading to reduced confidentiality, integrity, and availability of cryptographic operations. The vulnerability was addressed in version 1.20 [truncated]