CVE-2026-95811Proof of concept (PoC) published · CISA

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it

CVSS score

6.5

EPSS probability

%0.4

Risk score

0.0

Published

24 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Vulnerability Timeline (Change History)

CVE-2026-95811 historical changes made to the vulnerability by NVD, CISA and MITRE:

Date	Actor / Source	Action / Description	Type	Previous value	New value
26.09.2026	nvd@nist.gov	Initial Analysis & CVSS Vector Assignment	CVSS V3.1	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
25.09.2026	CISA Coordinator	SSVC Risk Re-assessment	SSVC / KEV	exploitation: none	exploitation: none
25.09.2026	MITRE / NVD	New CVE Record Received & Ingested	CVE Created	—	CVE-2026-95811

Similar Vulnerabilities

9.8

CVE-2026-19349Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

VendorCPANSec ProductLemonldap-NG-Portal

Patch status unknownEPSS %12 mo ago

9.8

CVE-2026-72887Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token

VendorCPANSec ProductNet-OAuth

Patch verifiedEPSS %12 mo ago

9.8

CVE-2026-78183DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float

VendorCPANSec ProductDBD-Pg

Patch verifiedEPSS %11 mo ago

9.1

CVE-2026-73639Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

VendorCPANSec ProductImager-File-PNG+1 etkilenen

Patch verifiedEPSS %11 mo ago

9.8

CVE-2026-73193DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse

VendorCPANSec ProductDBI

Patch verifiedEPSS %12 mo ago

9.8

CVE-2026-78619Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

VendorCPANSec ProductPunk-TOTP

Patch status unknownEPSS %11 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-95811"

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it

Vulnerability Timeline (Change History)

Similar Vulnerabilities

Get this vulnerability through the API

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration