The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99212 advisory.

    CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses.
    Major features including processing form submissions, file uploads, reading and writing cookies, query     string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation     utilities are included as well.  CGI.pm performs very well in in a vanilla CGI.pm environment and also     comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.

    Security Fix(es):

    * perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)

    * perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)

    * perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and     Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-     Disposition header, unchanged. An application that saves the upload under this name can be made to write     outside the intended directory. (CVE-2026-120641)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99214 advisory.

    CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses.
    Major features including processing form submissions, file uploads, reading and writing cookies, query     string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation     utilities are included as well.  CGI.pm performs very well in in a vanilla CGI.pm environment and also     comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.

    Security Fix(es):

    * perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)

    * perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)

    * perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99215 advisory.

    CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses.
    Major features including processing form submissions, file uploads, reading and writing cookies, query     string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation     utilities are included as well.  CGI.pm performs very well in in a vanilla CGI.pm environment and also     comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.

    Security Fix(es):

    * perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)

    * perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)

    * perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3a026d9ff advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:99213 advisory.

    CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses.
    Major features including processing form submissions, file uploads, reading and writing cookies, query     string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation     utilities are included as well.  CGI.pm performs very well in in a vanilla CGI.pm environment and also     comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.

    Security Fix(es):

    * perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)

    * perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)

    * perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
378028	Fedora 45 : perl-CGI (2026-a04615c725)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
379419	RHEL 10 : perl-CGI (RHSA-2026:99212)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical
375711	Linux Distros Unpatched Vulnerability : CVE-2026-120641	Nessus	Misc.	11/4/2026	11/12/2026	high
379357	RHEL 10 : perl-CGI (RHSA-2026:99214)	Nessus	Red Hat Local Security Checks	11/11/2026	11/11/2026	critical
379410	RHEL 9 : perl-CGI (RHSA-2026:99215)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical
378029	Fedora 44 : perl-CGI (2026-516e427bac)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378037	Fedora 43 : perl-CGI (2026-a3a026d9ff)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
379393	RHEL 9 : perl-CGI (RHSA-2026:99213)	Nessus	Red Hat Local Security Checks	11/12/2026	11/12/2026	critical

Detections

Analytics

Plugins Search

critical

critical

high

critical

critical

critical

critical

critical