XML::Sig — Vulnerabilities & Security Advisories 4

All 4 CVE vulnerabilities found in XML::Sig, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-18568	XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check CWE-347	-	-	2026-08-03
CVE-2026-9487	XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID CWE-347	-	-	2026-08-03
CVE-2026-9390	XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup CWE-643	-	-	2026-08-03
CVE-2025-40934	XML-Sig prior to 0.68 for Perl improperly validates XML without signatures CWE-347	7.5^AI	High ^AI	2025-11-26

All 4 known CVE vulnerabilities affecting XML::Sig with full Chinese analysis, references, and POCs where available.