SRI vulnerabilities
We track 2 vulnerabilities in SRI products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 14, 2026.
2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score
Latest SRI vulnerabilities
- 9.1 Critical severity
Mojolicious: Observable Response Discrepancy
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places
- 8.1 High severity
Mojolicious: Use of Hard-coded Cryptographic Key
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who know