CVE-2026-11832

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.

The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-118338.2Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server settingCVE-2026-118348.7A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficCVE-2026-118355.7Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subCVE-2026-118361.8Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode alloCVE-2026-118377.3A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.choCVE-2026-118384.3Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems IndCVE-2026-118399.9Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell tCVE-2026-11847.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 tCVE-2026-118408.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticateCVE-2026-118419.4An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due tCVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remCVE-2026-118457.2The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged re