CVE-2026-13082Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-338CWE-804

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Open Source Security mailing list@oss_security92d
Disclosure
Perl CPAN CVE-2026-13410: Dancer::Plugin::Auth::Google through 0.07 have TLS verification disabled https://www.openwall.com/lists/oss-security/2026/07/17/8 CVE-2026-13082: GD::SecurityImage through 1.75 use rand to generate secrets https://www.openwall.com/lists/oss-security/2026/07/17/9
Post summary
The passage lists two Perl CPAN CVEs, noting TLS verification is disabled in Dancer::Plugin::Auth::Google and that GD::SecurityImage generates secrets with a weak random function.
10000161
4.7K followersView on X

Explore more

Back to dashboard