CVE-2026-18568Suited to automated attack · CISA
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check
CVSS score
7.5
EPSS probability
%0.3
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.1
CVE-2026-9390
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
T
Patch verifiedEPSS %1
9.8
CVE-2026-18108
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature
T
Patch verifiedEPSS %0
8.1
CVE-2026-18092
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree
T
Patch verifiedEPSS %0
9.1
CVE-2026-9487
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
T
Patch verifiedEPSS %0
7.5
CVE-2026-18089
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
T
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-18568"