CVE-2026-111946Medium· 5.3▾ SunlitPlack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
0.2% → 0.3%
— → 5.3
none → medium
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.
When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
Plack-Middleware-ETag >= 0.04 < 0.06Upgrade to Plack-Middleware-ETag 0.06 or later. Where the file_etag option is set, remove the use of "inode".
For deployments that cannot upgrade to 0.06, where the file_etag option is set, remove the use of "inode". If the file_etag option is not specified, change it to ["mtime", "size"].
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44945Critical· 9.1A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go)
CVE-2026-109823Low· 2.3Host filesystem path disclosure via DNS rebinding
CVE-2026-111079High· 7.4Goose: goose: shell history and environment leak via terminal integration
CVE-2026-76435Medium· 5.3Cisco Expressway Series Information Disclosure Vulnerability
CVE-2026-108089High· 7.5Apache Cocoon: Unauthenticated access to diagnostic interfaces
CVE-2026-110855Medium· 6.5GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url()…