C-Kermit, Wicket, and Perl auth fixes

Several security advisories appeared on oss-security for long-lived tools and web components. The reports cover remote code execution, authentication weaknesses, and injection issues in C-Kermit, Apache Wicket, and two Perl modules.

Multiple vulnerabilities fixed in C-Kermit

Security advisories were published for remote code execution, authentication bypass, and file-write flaws in C-Kermit. The problems were addressed in version 11.1.515 after decades of exposure. Operators still relying on this file-transfer utility have a clear reason to move to the fixed release.

Apache Wicket closes 19 CVEs

Apache Wicket released fixes for 19 CVEs, mostly medium severity, in versions 8.20.0, 9.25.0, and 10.12.0. The 8.x and 9.x lines are reaching end of life with these updates. Java web applications built on Wicket need to schedule upgrades before support ends.

Two CVEs in Google::Auth for Perl

Two CVEs were disclosed for the Google::Auth Perl module. One concerns SSRF through credential_source and the other a missing OAuth state check. Perl code that uses the module for Google authentication should treat the updates as required.

Memcached command injection in HTTP::Session

CVE-2026-13575 describes memcached command injection in HTTP::Session::Store::CHI for Perl versions before 0.54. Unfiltered session identifiers reach the store and enable the injection. Sites using this session backend need to move to 0.54 or later.