{"vulnerability": "cve-2026-9371", "sightings": [{"uuid": "0c8916a4-4cb7-413d-81b3-9cbcb5ea9099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93712", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117355905121711720", "content": "CVE-2026-93712 Dancer2 path traversal (CVSS 7.5): File route handler lets /../outside.txt escape public_dir. Off by default, but affected apps should patch as soon as the fix lands. https://www.valtersit.com/cve/CVE-2026-93712/ #CVE #infosec #Perl", "creation_timestamp": "2026-09-29T19:10:04.538697Z"}, {"uuid": "23f5d067-a3f3-4fce-b099-0122505dce8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93711", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwpfp64zjn27", "content": "CVE-2026-93711 Dancer2 before 2.2.0 fails to strip CRLF from response header names, enabling header injection when names come from request data. CVSS 6.5. Patch under review. Audit your Perl apps now. https://www.valtersit.com/cve/CVE-2026-93711/ #CVE #infosec #Perl", "creation_timestamp": "2026-09-30T03:30:05.297158Z"}, {"uuid": "036d1fe3-6669-4e9c-9875-054b4196f3a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93711", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117357871455951908", "content": "CVE-2026-93711 Dancer2 before 2.2.0 fails to strip CRLF from response header names, enabling header injection when names come from request data. CVSS 6.5. Patch under review. Audit your Perl apps now. https://www.valtersit.com/cve/CVE-2026-93711/ #CVE #infosec #Perl", "creation_timestamp": "2026-09-30T03:30:07.893269Z"}]}