CVE-2026-16235Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-338

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-20); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-20	2	Disclosure2
2026-07-22	1	General1

Full discourse3 posts

Open Source Security mailing list@oss_security90d
General
Perl CPAN Crypt::Password through 0.28 CVE-2026-16235: Generate insecure random values for salts https://www.openwall.com/lists/oss-security/2026/07/20/3 CVE-2026-6656: Susceptible to timing attacks https://www.openwall.com/lists/oss-security/2026/07/20/4
Post summary
The tweet announces two new CVEs (CVE-2026-16235 and CVE-2026-6656) affecting Perl CPAN Crypt::Password, providing brief technical details but no PoC, exploit code, patch, or evidence of active exploitation.
1000050
4.7K followersView on X
SecAlerts@SecAlertsCo91d
Disclosure
🎲 Crypt::Password ≤0.28 for Perl uses rand() to generate password salts. rand() is predictable and not cryptographically safe — making your "hashed" passwords far easier to crack. CVE-2026-16235, CVSS 9.8. https://secalerts.co/vulnerability/CVE-2026-16235?utm_campaign=x https://t.co/DkQ1oGFG3m
Post summary
The tweet announces the discovery of CVE‑2026‑16235, highlighting that Crypt::Password uses insecure rand() for password salts, and assigns it a high CVSS score, without providing patches, PoCs, or reports of active exploitation.
00000108
863 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
Disclosure
CVE-2026-16235 Insecure Random Salt Generation in Crypt::Password for Perl Through 0.28 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16235
Post summary
The text announces CVE-2026-16235, describing an insecure random salt generation issue in Crypt::Password for Perl up to version 0.28, without providing exploit details, patches, or active exploitation evidence.
0000083
4.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-16235

Open Source Security mailing list@oss_securityGeneral

The tweet announces two new CVEs (CVE-2026-16235 and CVE-2026-6656) affecting Perl CPAN Crypt::Password, providing brief technical details but no PoC, exploit code, patch, or evidence of active exploitation.

SecAlerts@SecAlertsCoDisclosure

The tweet announces the discovery of CVE‑2026‑16235, highlighting that Crypt::Password uses insecure rand() for password salts, and assigns it a high CVSS score, without providing patches, PoCs, or reports of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE-2026-16235, describing an insecure random salt generation issue in Crypt::Password for Perl up to version 0.28, without providing exploit details, patches, or active exploitation evidence.