Watch card · compiled automatically, not analysed

CVE-2026-110753

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With…

Vulnerable dependency

AI summaryText::CSV_XS 1.46 to before 1.65 has a use-after-free when bind_columns is used and skip_empty_rows skips an empty line in getline.

Our research pipeline compiles this page from public data. It contains no human judgement from PlainCVE; rely on the original advisories for facts.

Our status

Candidate — Not queued for research yet. Below is public data only.

Key numbers

CVSS: 9.8 v3.1
CISA KEV: Not listed
EPSS: 0.34%
Momentum: 2.8 Steady

Timeline

2026-10-16DisclosedNVD
2026-10-16First reportedoss-security

How much time similar vulnerabilities gave

This item is not mapped to a category yet, so here are the overall numbers: of 390 vulnerabilities disclosed since 2025 and added to KEV, the median time from disclosure to KEV was 5 days; 54% were added within 7 days.

This one: not in KEV so far (that does not mean it is not exploited).

Counts only vulnerabilities CISA has confirmed as exploited; disclosure is the NVD publication date, which can differ from the vendor advisory.

What drives the momentum

Coverage(mailing lists)+2.8

Coverage

2026-10-16 oss-security

Primary sources

Watch cards update with This week every 3 hours. Once we write this up, this URL will point to the write-up.