https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T23:40:24.484501+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120638 fkie_cve-2026-120638 2026-11-08T23:40:24.487925+00:00

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

 https://db.gcve.eu/vuln/ghsa-33j8-q94p-w495 GHSA-33j8-q94p-w495 2026-11-08T23:40:24.488009+00:00

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.

redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

 https://db.gcve.eu/vuln/msrc_cve-2026-120638 msrc_CVE-2026-120638 — CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation… 2026-11-08T23:40:24.488034+00:00 msrc_CVE-2026-120638 https://db.gcve.eu/vuln/opensuse-su-2026:12465-1 openSUSE-SU-2026:12465-1 — perl-CGI-5.20.0-1.1 on GA media 2026-11-08T23:40:24.488059+00:00

perl-CGI-5.20.0-1.1 on GA media

 https://db.gcve.eu/vuln/ubuntu-cve-2026-120638 UBUNTU-CVE-2026-120638 2026-11-08T23:40:24.488083+00:00

Affected: Ubuntu:16.04:LTS: libcgi-pm-perl, Ubuntu:18.04:LTS: libcgi-pm-perl, Ubuntu:20.04:LTS: libcgi-pm-perl, Ubuntu:22.04:LTS: libcgi-pm-perl, Ubuntu:24.04:LTS: libcgi-pm-perl, Ubuntu:26.10: libcgi-pm-perl, Ubuntu:26.04:LTS: libcgi-pm-perl

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.