CVE-2026-9487Suited to automated attack · CISA

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

CVSS score

9.1

EPSS probability

%0.3

Risk score

0.0

Published

2 mo ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.1

CVE-2026-9390XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

VendorTIMLEGGE ProductXML::Sig+2 etkilenen

Patch verifiedEPSS %12 mo ago

9.8

CVE-2026-18108Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature

VendorTIMLEGGE ProductNet::SAML2+1 etkilenen

Patch verifiedEPSS %02 mo ago

8.1

CVE-2026-18092Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree

VendorTIMLEGGE ProductNet::SAML2+1 etkilenen

Patch verifiedEPSS %02 mo ago

7.5

CVE-2026-18568XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

VendorTIMLEGGE ProductXML::Sig+2 etkilenen

Patch verifiedEPSS %02 mo ago

7.5

CVE-2026-18089Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured

VendorTIMLEGGE ProductNet::SAML2+1 etkilenen

Patch status unknownEPSS %02 mo ago

9.3

CVE-2025-40934Vulnerability in Xml\

$xml\ logo$

Vendorxml\Product\

Patch verifiedEPSS %010 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-9487"

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID

Related Security News

Similar Vulnerabilities

Get this vulnerability through the API

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration