CVE-2026-8704

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-552

Affected software

VendorProductVersions
TIMLEGGECrypt::DSA<= 1.19

References

Timeline

Published
May 15, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-870408.3The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU againCVE-2026-870417.8The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated thCVE-2026-870426.5The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received Delay_Resp message wCVE-2026-870434.8The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as dCVE-2026-870446.5The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() anCVE-2026-870457.5The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every frame. handle_httpCVE-2026-870464.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870476.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-870485.4Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-87057.5The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_pCVE-2026-87066.5Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrCVE-2026-870678.5The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value take
CVE-2026-8704: Medium severity, CVSS 6.5 | Vulnix