Vendor security profile

CPANSec

Product portfolio, patch evidence and exploitation signals in a single security scorecard

The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page

Total CVEs71

Critical23

CISA KEV0

Public exploit7

Patch rate%73

Avg. CVSS7.7

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

Kas

Ara

Oca

Şub

Mar

Nis

May

Haz

Tem

Ağu

Eyl

Eki

CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

71toplam CVE

Critical23 (32%)

High22 (31%)

Medium21 (30%)

Low1 (1%)

Uncertain4 (6%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

%73

Verified patch

52 records

CISA KEV

0 records

%10

Public exploit

7 records

50Patch available

2Partial

0Workaround

0Vendor: no patch

19Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all

CVE-2026-107794

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

VendorCPANSecProductExtUtils-Typemaps-Default

Patch status unknownEPSS %01 d ago

CVE-2013-10076

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

VendorCPANSecProductExtUtils-Typemaps-Default

Patch verifiedEPSS %01 d ago

CVE-2026-107373

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

VendorCPANSecProductExtUtils-Typemaps-Default

Patch status unknownEPSS %01 d ago

5.3

CVE-2026-104380

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

VendorCPANSecProductPunk

Patch verifiedEPSS %06 d ago

5.4

CVE-2026-19954

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

VendorCPANSecProductNet-Whois-Raw

Patch verifiedEPSS %07 days ago

7.3

CVE-2019-25777

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

VendorCPANSecProductYAML

Patch verifiedEPSS %07 days ago

9.1

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

VendorCPANSecProductYAML

Patch verifiedEPSS %07 days ago

6.3

CVE-2026-102505

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

VendorCPANSecProductImager+2 etkilenen

Patch verifiedEPSS %010 d ago

7.5

CVE-2026-102504

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

VendorCPANSecProductImager+2 etkilenen

Patch verifiedEPSS %010 d ago

CVE-2026-80490

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified

VendorCPANSecProductAlgorithm-AhoCorasick-XS

Patch verifiedEPSS %011 d ago

CPANSec

12-month vulnerability rate

CVE severity distribution

Patch and exploitation view

Latest vulnerabilities

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration