CVE-2026-13082
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in the GD::SecurityImage library for Perl (versions up to 1.75) uses the rand function to generate CAPTCHA secrets. The rand function is predictable and reversible, making it unsuitable for security purposes.
Risk Assessment
An attacker can predict or reconstruct the CAPTCHA text, enabling automated attacks (e.g., brute-force, spam) that bypass CAPTCHA protections.
Recommendation
Update the GD::SecurityImage library to a version newer than 1.75 that uses a secure random number generator (e.g., from the Crypt::Random module).
Related vulnerabilities
- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-108497Critical
The Amelia Booking plugin (up to 2.4.10) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker could execute arbitrary SQL queries, potentially leading to data leakage or modification.
- CVE-2026-50619Critical
A path traversal vulnerability has been reported in Qsirch, which could allow remote attackers to read unexpected files or system data. The vulnerability has been fixed in version 7.0.3.0 and later.
- CVE-2026-50612Critical
A Unix symbolic link (symlink) following vulnerability has been reported in QuMagie. If a remote attacker gains a user account, they can exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in version 2.9.2 and later.
- CVE-2026-47786Critical
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
- CVE-2026-34006Critical
A missing authentication for critical function vulnerability has been reported in sMedio DTCP MOVE, which could allow remote attackers to gain access to the system. The vulnerability has been fixed in version 1.4.5 and later.
- CVE-2026-19863Critical
In EthereumAuthenticator, an unauthenticated client may access certain protected resources if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page, which may replace authentication or role requirements with ALLOWED.
- CVE-2026-16438Critical
Mitsubishi Electric products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64) versions 10.97.3 and prior contain an incorrect privilege assignment vulnerability. Installers grant default DCOM permissions to the administrator account, allowing an attacker to locally or remotely launch and operate DCOM objects that should require UAC elevation.
- CVE-2026-16436Critical
Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.
- CVE-2026-102469Critical
The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.
Original NVD description (English source)
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS