Date Index - October 2026 - CPANSec CVE announcements

01 Oct 2026 13:13 UTC	CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol	Stig Palmquist
01 Oct 2026 13:13 UTC	CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp	Stig Palmquist
05 Oct 2026 06:52 UTC	CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution	Stig Palmquist
05 Oct 2026 06:54 UTC	CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes	Stig Palmquist
05 Oct 2026 06:55 UTC	CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names	Robert Rothenberg
06 Oct 2026 01:14 UTC	CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one	Timothy Legge