What you need to know today.
Perl modules YAML::Syck and XML::Bare, along with Cyrus IMAP, face multiple vulnerabilities including memory corruption and access control bypasses.
Multiple vulnerabilities have been disclosed in Perl's YAML::Syck module, affecting versions prior to 1.47. These include heap use-after-free flaws related to anchor name handling (CVE-2026-57076, CVE-2026-13713), an out-of-bounds read in the base64 decoder (CVE-2026-57075), and an out-of-bounds read due to an unbounded newline scan (CVE-2026-57077). These issues stem from vulnerabilities in the bundled libsyck library and could lead to memory corruption or denial of service. Users are advised to update to versions 1.47 or later.
A series of vulnerabilities have been identified in Cyrus IMAP through version 3.12.2. These include URLAUTH token forgery (CVE-2026-47085, CVE-2026-47087), bypass of ACL checks for the LOCALDELETE command (CVE-2026-47084), improper handling of the vacation "fcc" feature (CVE-2026-47082), and exposure of heap information in nested MIME comments (CVE-2026-47088). Additionally, LISTRIGHTS command information is not limited to administrators (CVE-2026-47089), and GENURLAUTH tokens can bypass ACLs (CVE-2026-47086). An XAPPLEPUSHSERVICE folder existence oracle and push hijack vulnerability also exists (CVE-2026-47081). These flaws could allow for unauthorized access, deletion of mailboxes, or information disclosure. Updates to version 3.12.3 or later are recommended.
In Perl's XML::Bare, versions up to 0.53 are vulnerable to an unbounded character lookahead (CVE-2026-57074), which could lead to denial of service when parsing malformed XML. Furthermore, the module can enter an infinite loop when parsing malformed attributes (CVE-2026-13401), potentially causing a denial of service. Users should update to patched versions.
A buffer overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler (CVE-2026-51105). No specific patch information is available, but updating to the latest version of aMule is recommended.
Several other low-risk vulnerabilities were disclosed, including CVE-2026-59173, CVE-2026-62320, CVE-2026-62321, CVE-2026-62319, and CVE-2026-62318, with limited details provided on their impact or affected systems.