Catalyst::Plugin::Authentication before 0.10029 allows timing attacks on passwords (CVE-2026-74846)
Legacy password verifier uses eq comparisons enabling timing attacks; fixed in version 0.10029.
Stories per day · 30 days
3 RSS
7 stories, newest first · one card per story
Stories tagged #catalyst
Cisco Catalyst SD-WAN peering flaw bypasses authentication for admin access
An unauthenticated remote attacker can send crafted requests and log in with administrative privileges.
Cisco SD-WAN Manager hit by zero-day admin access attack
Cisco patched CVE-2026-76504, a critical SD-WAN Manager authentication bypass already used for remote admin access.
Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco says attackers are exploiting critical SD-WAN Manager auth-bypass zero-day CVE-2026-76504.
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
Cisco warns an SD-WAN Manager API flaw lets unauthenticated attackers gain admin access.
Re: CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone
A follow-up corrects the VCS repository cited for Catalyst::Seal CVE-2026-85491, citing bad module metadata.
CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone
Catalyst::Seal before 0.03 can let one request bypass authorization on a later request (CVE-2026-85491).