https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-15T06:00:22.123729+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-abcde-cve-2026-77568 BREW-abcde-CVE-2026-77568 — Mojolicious: CSRF tokens are vulnerable to BREACH attacks 2026-10-15T06:00:22.128659+00:00

Affected: Homebrew: abcde

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.

 https://db.gcve.eu/vuln/fkie_cve-2026-77568 fkie_cve-2026-77568 2026-10-15T06:00:22.128745+00:00

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

 https://db.gcve.eu/vuln/opensuse-su-2026:21956-1 openSUSE-SU-2026:21956-1 — Security update for perl-Mojolicious 2026-10-15T06:00:22.128788+00:00

Security update for perl-Mojolicious

 https://db.gcve.eu/vuln/ubuntu-cve-2026-77568 Withdrawn: UBUNTU-CVE-2026-77568 2026-10-15T06:00:22.128822+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:26.04:LTS: perl

Mojolicious is a real-time web framework for Perl. Prior to 9.48, the Mojolicious CSRF helpers csrf_field, csrf_token, and csrf_protect reuse an unchanged per-session token in rendered HTML. When response compression is enabled and attacker-influenced content is reflected in the same response, an unauthenticated attacker who can induce many victim requests and observe response sizes can use a BREACH compression side channel to recover the token and forge cross-site requests. API-only deployments that never render the token in HTML are not affected. This issue is fixed in version 9.48.