Yes, there are a couple of known bugs. For
example:
o A few methods that are currently documented
are not actually implemented. So far, you only
have read access to RCS and CVS repositories..
o Caching is done inside the Rcs.pm and Cvs.pm
libraries, while it should probably be inside
the Rcs::File and Cvs::File libraries.
o Caching doesn't work for long-lived processes.
o vcsweb.cgi does not run correctly with tainting
But hopefully that's about it ;-)