CVE-2026-120644

CriticalCVSS 9.1/10Last modified Nov 9, 2026

Description

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.

The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.

An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1206457.5CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. WhCVE-2026-1206467.5CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. CVE-2026-1206479.8CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenamCVE-2026-1206486.1CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> withouCVE-2026-120651.8A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the componenCVE-2026-1206506.5CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.CVE-2026-1206517.5CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD orCVE-2026-1206567.5OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS CVE-2026-1206586.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in alCVE-2026-1206595.3The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 TCVE-2026-120667.3A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controlCVE-2026-120676.5Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the
CVE-2026-120644: Critical severity, CVSS 9.1 | Vulnix