Threats Tagged 'cve-2026-15747'
View all threats tagged with 'cve-2026-15747'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-15747'
Click on any threat for detailed analysis and mitigation recommendations
0 A security update for perl-Mojolicious addresses a vulnerability (CVE-2026-15747) where CSRF tokens were susceptible to BREACH attacks due to token reuse across a session. The update changes token handling to mask tokens with a fresh random value on every request. Additional fixes include limiting JSON decoding depth to prevent memory exhaustion and various improvements and bug fixes in the Mojolicious framework. Join the discussion | GCVE Database | 07/29/2026, 09:24:06 UTC Added: 09/17/2026, 01:59:01 UTC |
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation. Join the discussion | CVE Database V5 | 07/14/2026, 17:07:32 UTC Added: 07/14/2026, 17:49:00 UTC |
Showing 1 to 2 of 2 results