Rurban vulnerabilities
We track 3 vulnerabilities in Rurban products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 14, 2026.
Latest Rurban vulnerabilities
- 9.8 Critical severity
GD: External Control of File Name or Path
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with
- 7.5 High severity
Cpanel::JSON::XS: Improper Handling of Exceptional Conditions
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set()
- 7.3 High severity
Cpanel::JSON::XS: Access of Resource Using Incompatible Type
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate