Advisories · Technology

SRI Mojolicious.

Every CVE that names SRI Mojolicious among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-15747 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
- SRI Mojolicious
- Cross-site request forgery (CSRF)
- CWE-204
Not analysed yet 14 Jul 2026
CVE-2024-58134 CVE record

CVSS 8.1 High

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default
- SRI Mojolicious
- Hard-coded credentials
- CWE-331
Not analysed yet 3 May 2025
CVE-2024-58135 CVE record

CVSS 5.3 Medium

Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default
- SRI Mojolicious
- Weak cryptography or TLS
Not analysed yet 3 May 2025