GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:11745-1

Vulnerability from csaf_opensuse - Published: 2026-09-10 00:00 - Updated: 2026-09-17 17:23
Summary
perl-HTML-FormHandler-0.410.2-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: perl-HTML-FormHandler-0.410.2-1.1 on GA media
Description of the patch: These are all security issues fixed in the perl-HTML-FormHandler-0.410.2-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11745
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2022-4993
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64 —
Vendor Fix
Threats
Impact critical
CVE-2026-19872
Affected products
Recommended 4 products, the same list as for CVE-2022-4993
Threats
Impact moderate
CVE-2026-85484
Affected products
Recommended 4 products, the same list as for CVE-2022-4993
Threats
Impact moderate
CVE-2026-85485
Affected products
Recommended 4 products, the same list as for CVE-2022-4993
Threats
Impact moderate
CVE-2026-85630
Affected products
Recommended 4 products, the same list as for CVE-2022-4993
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-HTML-FormHandler-0.410.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-HTML-FormHandler-0.410.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11745",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11745-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-4993 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-4993/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-19872 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-19872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-85484 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-85484/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-85485 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-85485/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-85630 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-85630/"
      }
    ],
    "title": "perl-HTML-FormHandler-0.410.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T17:23:54Z",
      "generator": {
        "date": "2026-09-10T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11745-1",
      "initial_release_date": "2026-09-10T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-10T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:27:56Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:30:33Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:23:54Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
                "product": {
                  "name": "perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
                  "product_id": "perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-HTML-FormHandler@0.410.2-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
                "product": {
                  "name": "perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
                  "product_id": "perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-HTML-FormHandler@0.410.2-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
                "product": {
                  "name": "perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
                  "product_id": "perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-HTML-FormHandler@0.410.2-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-HTML-FormHandler-0:0.410.2-1.1.x86_64",
                "product": {
                  "name": "perl-HTML-FormHandler-0:0.410.2-1.1.x86_64",
                  "product_id": "perl-HTML-FormHandler-0:0.410.2-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-HTML-FormHandler@0.410.2-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-HTML-FormHandler-0:0.410.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64"
        },
        "product_reference": "perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le"
        },
        "product_reference": "perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-HTML-FormHandler-0:0.410.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x"
        },
        "product_reference": "perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-HTML-FormHandler-0:0.410.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        },
        "product_reference": "perl-HTML-FormHandler-0:0.410.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4993",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-4993"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-4993",
          "url": "https://www.suse.com/security/cve/CVE-2022-4993"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 826505 for CVE-2022-4993",
          "url": "https://bugzilla.suse.com/826505"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-10T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2022-4993"
    },
    {
      "cve": "CVE-2026-19872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-19872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message.\n\nThe wrappers and renderers that emit a form\u0027s errors interpolate the error string straight into HTML with no escaping. Two of the library\u0027s own messages, no_match and not_allowed, splice the submitted value into that string, and a failing type constraint puts the rejected value into the message it builds, which _apply_actions hands to add_error.\n\nA field declared with a check regexp, a check list or a type constraint reaches those messages, with no custom validator and no non-default configuration. Errors rendered through an application\u0027s own escaping template layer rather than the library\u0027s rendering roles are not affected.\n\nA request over the network that submits markup to such a field gets it back live inside the error span, running script in the victim\u0027s origin. Re-rendering a rejected value later gives the stored variant.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-19872",
          "url": "https://www.suse.com/security/cve/CVE-2026-19872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279868 for CVE-2026-19872",
          "url": "https://bugzilla.suse.com/1279868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279870 for CVE-2026-19872",
          "url": "https://bugzilla.suse.com/1279870"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-19872"
    },
    {
      "cve": "CVE-2026-85484",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-85484"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping.\n\nThe Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button\u0027s own label unescaped.\n\nAny application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-85484",
          "url": "https://www.suse.com/security/cve/CVE-2026-85484"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279869 for CVE-2026-85484",
          "url": "https://bugzilla.suse.com/1279869"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-85484"
    },
    {
      "cve": "CVE-2026-85485",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-85485"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping.\n\nThe Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three.\n\nError messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-85485",
          "url": "https://www.suse.com/security/cve/CVE-2026-85485"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279870 for CVE-2026-85485",
          "url": "https://bugzilla.suse.com/1279870"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-85485"
    },
    {
      "cve": "CVE-2026-85630",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-85630"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.\n\nAny application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages.\n\nFor example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
          "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-85630",
          "url": "https://www.suse.com/security/cve/CVE-2026-85630"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1279871 for CVE-2026-85630",
          "url": "https://bugzilla.suse.com/1279871"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.aarch64",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.s390x",
            "openSUSE Tumbleweed:perl-HTML-FormHandler-0:0.410.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-10T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-85630"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.