CVE-2026-46720

HighCVSS 8.2/10Last modified Jun 19, 2026

Description

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections.

The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-93 CWE-150

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2026
Last modified: Jun 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-467216.9The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user grou CVE-2026-467225.9The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed dire CVE-2026-467235.9The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permiss CVE-2026-467245.9The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index d CVE-2026-467259.2The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenti CVE-2026-467267.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in A CVE-2026-467278.1An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handle CVE-2026-467288.8Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.CVE-2026-467297.5NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Serv CVE-2026-46738.8Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write CVE-2026-467304.2Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1 CVE-2026-467317.8Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability.