{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/webdyne/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webdyne:for_perl:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-78188"},{"id":"CVE-2026-78189"},{"id":"CVE-2026-78190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebDyne for Perl (2.014-3.021)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WebDyne"],"content_html":"\u003cp\u003eRobert Rothenberg reported three vulnerabilities in WebDyne for Perl:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-78188: Versions 2.014 through 3.021 issue session cookies without Secure, HttpOnly, and SameSite attributes.\u003c/li\u003e\n\u003cli\u003eCVE-2026-78189: Versions 3.007 through 3.021 allow the execution of .psp files outside the document root via path traversal in the PSGI API route fallback.\u003c/li\u003e\n\u003cli\u003eCVE-2026-78190: Versions 2.014 through 3.021 reflect request parameters unescaped into form fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T19:51:40Z","date_published":"2026-10-31T19:51:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webdyne-perl-vulnerabilities/","summary":"WebDyne for Perl is affected by multiple vulnerabilities involving session cookie attributes, path traversal, and unescaped request parameters.","title":"WebDyne for Perl: Multiple Vulnerabilities (CVE-2026-78188, CVE-2026-78189, CVE-2026-78190)","url":"https://feed.craftedsignal.io/briefs/2026-10-webdyne-perl-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - WebDyne","version":"https://jsonfeed.org/version/1.1"}