CVE-2026-120640 is a vulnerability affecting CGI versions before 5.00 for Perl. It involves the ability to set the POSTDATA, PUTDATA, PATCHDATA, and XForms:Model parameters in an unintended manner. The advisory references the Microsoft Support Lifecycle for software support details but does not provide further technical or impact specifics.
A vulnerability exists in CGI versions before 5.00 for Perl that allows open redirects through HTML entity decoding of the URL after application processing. This issue is identified as CVE-2026-120638 and is associated with CWE-180. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-120637 is a vulnerability affecting CGI versions before 5.00 for Perl, where request parameters are taken from the process command line arguments for an unrecognized condition. The advisory references Microsoft products but provides no detailed technical or impact information. No patch or remediation details are provided.
CVE-2026-120633 is a vulnerability in CGI versions before 5.00 for Perl where the software trusts the client-supplied X-Forwarded-Host header in url, self_url, and virtual_host. This could potentially lead to security issues related to improper validation of host headers. The affected product is Microsoft CGI for Perl version 3.0. No CVSS score or detailed impact information is provided.
A vulnerability exists in CGI versions before 5.00 for Perl that allows CPU exhaustion through a backtracking regular expression in the XForms multipart/related processing. This can lead to denial of service conditions by consuming excessive CPU resources.
CVE-2026-120634 is a vulnerability in CGI::Carp versions before 5.00 for Perl that causes warnings to leak across requests in persistent environments. The issue relates to improper handling of warnings, potentially leading to information leakage between requests. No CVSS score or detailed impact information is provided.
A vulnerability exists in CGI versions before 5.00 for Perl where an infinite loop can occur on a short request body if the $DISABLE_UPLOADS variable is set. This issue is identified as CWE-835 (Loop with Unreachable Exit Condition). The affected version explicitly stated is version 3.0. No CVSS score or patch information is provided, and no known exploits are reported in the wild.
CVE-2026-120650 affects CGI versions before 5.00 for Perl, allowing memory, CPU, and disk exhaustion due to missing or unenforced request size limits. This vulnerability can lead to resource exhaustion on affected systems.
A vulnerability in CGI versions before 5.00 for Perl allows HTML injection when text containing the sequence '-->' is included in comments. This issue is identified as CVE-2026-120648 and is associated with Microsoft products. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-120647 is a vulnerability in CGI versions before 5.00 for Perl that allows Content-Disposition parameter injection via unescaped double quotes. The vulnerability relates to improper handling of input leading to injection risks. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the provided data.
A vulnerability exists in CGI versions before 5.00 for Perl where upload filenames are returned with any client-supplied path, including directory traversal sequences like ../ and Windows-style paths. This could potentially lead to security issues related to path handling.
CVE-2026-120644 is a vulnerability in CGI::Cookie versions before 5.00 for Perl that allows cookie attribute injection through unvalidated path, domain, and expires parameters. This flaw relates to improper input validation leading to potential manipulation of cookie attributes.
CVE-2026-120642 is a vulnerability affecting CGI versions before 5.00 for Perl, where request-derived values are returned untainted under taint mode. This behavior can lead to improper handling of potentially unsafe input data in Perl CGI scripts.
A vulnerability in CGI versions before 5.00 for Perl allows HTTP header injection via entity decoding after the newline check in headers. This flaw relates to improper handling of HTTP headers, potentially enabling injection attacks.
CVE-2026-120636 affects CGI versions before 5.00 for Perl, allowing open redirect and script injection vulnerabilities via URLs constructed from REQUEST_URI in certain parameters. The vulnerability is classified under CWE-601 (Open Redirect). The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.
A vulnerability exists in CGI versions before 5.00 for Perl that allows form fields to be smuggled past proxies and web application firewalls (WAFs) via multipart parsing. This could potentially bypass security controls that rely on proper parsing of multipart form data. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided.
A denial of service vulnerability exists in CGI versions before 5.00 for Perl, where submitted values are used as a regular expression for optgroup selection. This can cause the application to become unresponsive or crash when processing crafted input.
CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd version 3.0 when emitting rpm-map artifacts. This flaw could potentially lead to memory access errors during processing.
A vulnerability in json-glib version 3.0 causes an infinite loop in the function json_path_query() when a negative jsonpath slice step is used. This flaw is identified as CWE-835 (Loop with Unreachable Exit Condition).
A vulnerability identified as CVE-2026-114456 affects multiple Snowflake client drivers due to missing origin validation in the externalbrowser authenticator callback. This flaw relates to improper validation of the origin in authentication callbacks, categorized under CWE-346. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact description is provided.