Rurban Cpanel::json::xs — known CVE vulnerabilities

Every CVE whose affected-product data names Rurban Cpanel::json::xs, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2022-48623 — CVSS 9.1 (critical): The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive…
• CVE-2026-9516 — CVSS 7.5 (high): Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws…
• CVE-2026-9334 — CVSS 7.3 (high): Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled…