CVE-2026-121007

Published 4 November 2026 · tracked since 5 November 2026

Description

SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-54372 HIGH 8.8
• CVE-2026-121751 LOW 3.1
• CVE-2026-121746 MEDIUM 5.5
• CVE-2026-121747 MEDIUM 5.5
• CVE-2026-121748 LOW 3.6
• CVE-2026-121749 LOW 3.3
• CVE-2026-121750 LOW 3.1
• CVE-2026-121745 LOW 2.5
• CVE-2026-103002 HIGH 8.8
• CVE-2026-102280

→ Open the live CVE board · all tools