These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-57077 is an out-of-bounds read vulnerability in YAML::Syck versions before 1.47 for Perl. The vulnerability is caused by an unbounded newline scan in newline_len, which can lead to an out-of-bounds read. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document bounda [truncated]
CVE-2026-57076 is a heap use-after-free vulnerability in YAML::Syck versions before 1.47 for Perl. The vulnerability occurs when an anchor name is reused as an anchors-table key in syck_hdlr_add_anchor, leading to a read of freed memory. This can be exploited by loading or loading a file on an untrusted document that redefines an anchor. The vulnerability has a high impact on the system, and developers an [truncated]
CVE-2026-57075 is an out-of-bounds read vulnerability in YAML::Syck versions before 1.47 for Perl. The base64 decoder in the bundled libsyck indexes a 256-entry static table with a signed char, allowing any !!binary byte >= 0x80 to sign-extend to a negative index and read before the table. This issue is triggered when Load or LoadFile is run on an untrusted document containing a !!binary scalar with a hig [truncated]
YAML::Syck versions before 1.47 for Perl are affected by a use-after-free and double-free vulnerability via an anchor node freed while still on the parser value stack. This denial of service vulnerability can be triggered by redefining or removing an anchor name, leading to a crash of the interpreter. Users of YAML::Syck should review and apply patches to prevent potential attacks.
CVE-2026-5090 affects Template::Plugin::HTML versions through 3.102 for Perl. According to the published description, the module's html_filter function did not escape single quotes, which means data placed into HTML attributes delimited by single quotes could break out of the attribute and inject limited HTML or JavaScript. The issue is narrower than full raw HTML injection because angle brackets, ampersa [truncated]
CVE-2006-10003 is an off-by-one heap buffer overflow vulnerability in the st_serial_stack function of XML::Parser versions up to 2.47 for Perl. The bug occurs when parsing an XML file with very deep element nesting and can lead to a critical CVSS score of 9.8. The issue arises from the incorrect handling of stack expansion when the stack pointer equals the stack size minus one. This CVE was officially pub [truncated]
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities, including a high-severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. Additionally, the base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data. A memory leak occ [truncated]