Vulnerabilities

TI-2026-69678 CVE-2026-107715 · GHSA-2mwr-xjcg-37j7

Mechanize leaks credential headers to other hosts after redirects

MEDIUM 63

The Mechanize library is used for automating interaction with websites.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00501 Published 2026-10-08 Partial fix · 2.15.0, 2.14.1 CWE-200

TI-2026-69771 CVE-2026-107714

Mechanize forwards credential headers across scheme and port redirects

LOW 26

The Mechanize library is used for automating interaction with websites.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00229 Published 2026-10-08 Partial fix · 2.15.0 CWE-200

TI-2026-69691 CVE-2026-107399 · GHSA-c6rp-p8xm-4q9f

Mechanize leaks configured headers to other origins on meta refresh

LOW 30

The Mechanize library is used for automating interaction with websites.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00362 Published 2026-10-08 Partial fix · 2.15.0, 2.14.1 CWE-200

TI-2026-55249 CVE-2026-79772 · GHSA-wx95-c6cv-8532

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

LOW 36

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00342 Published 2026-08-25 Partial fix · 1.19.1 CWE-252

TI-2026-55248 CVE-2026-79771 · GHSA-v2fc-qm4h-8hqv

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

LOW 37

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00423 Published 2026-08-25 Partial fix · 1.19.3 CWE-401

TI-2026-55247 CVE-2026-79770 · GHSA-c4rq-3m3g-8wgx

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

MEDIUM 44

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-08-25 Fixed in 1.19.3 CWE-1333

TI-2026-55246 CVE-2026-79769 · GHSA-58vh-2xxg-v7j2

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

MEDIUM 43

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00306 Published 2026-08-25 Partial fix · 1.19.4 CWE-843

TI-2026-39451 CVE-2026-54620 · GHSA-j7fr-3v8c-3qc3

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

LOW 10

sqlite3 provides Ruby bindings for the SQLite3 embedded database.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00142 Published 2026-07-28 Fixed in 2.9.5 CWE-416

TI-2026-39450 CVE-2026-54619 · GHSA-28hh-pr2h-2w89

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

LOW 10

sqlite3 provides Ruby bindings for the SQLite3 embedded database.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00142 Published 2026-07-28 Partial fix · 2.9.5 CWE-416

TI-2026-41375 CVE-2026-57438

Nokogiri: Possible Use-After-Free in XInclude Processing

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 2.2 Local No auth No interaction EPSS 0.00125 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41374 CVE-2026-57437

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00402 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41373 CVE-2026-57436

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

LOW 18

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00402 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41372 CVE-2026-57435

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2026-41371 CVE-2026-57434

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

LOW 16

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0046 Published 2026-06-25 Partial fix · 1.19.4 CWE-476

TI-2026-41173 CVE-2026-57235

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

LOW 28

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00426 Published 2026-06-25 Partial fix · 1.19.4 CWE-125

TI-2026-41172 CVE-2026-57234

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

LOW 13

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.00198 Published 2026-06-25 Fixed in 1.19.4 CWE-178

TI-2026-41174 CVE-2026-57236

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

LOW 10

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00426 Published 2026-06-25 Partial fix · 1.19.4 CWE-416

TI-2025-05895 CVE-2025-6494

sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow

MEDIUM 55

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00185 Published 2025-06-22 No fix listed CWE-119

TI-2025-05891 CVE-2025-6490

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

MEDIUM 55

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00185 Published 2025-06-22 No fix listed CWE-119

TI-2022-07536 CVE-2022-23476 · GHSA-qv4q-mr5r-qprj

Unchecked return value from xmlTextReaderExpand in Nokogiri

MEDIUM 42

Nokogiri is an open source XML and HTML library for the Ruby programming language.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01823 Published 2022-12-08 Partial fix · 1.13.10 CWE-252

TI-2022-13078 CVE-2022-31033 · GHSA-64qm-hrgp-pgr9

Authorization header leak in rubygem Mechanize

LOW 36

The Mechanize library is used for automating interaction with websites.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01523 Published 2022-06-09 Fixed in 2.8.5 CWE-200

TI-2022-11724 CVE-2022-29181 · GHSA-xh29-r2w5-wx8m

Improper Handling of Unexpected Data Type in Nokogiri

HIGH 75

Nokogiri is an open source XML and HTML library for Ruby.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0323 Published 2022-05-20 Partial fix · 1.13.6 CWE-241

TI-2022-08651 CVE-2022-24839 · GHSA-9849-p7jc-9rmv

Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)

MEDIUM 43

org.cyberneko.html is an html parser written in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02165 Published 2022-04-11 Partial fix · 1.9.22.noko2 CWE-400

TI-2022-08648 CVE-2022-24836 · GHSA-crjr-9rc5-ghw8

Inefficient Regular Expression Complexity in Nokogiri

LOW 39

Nokogiri is an open source XML and HTML library for Ruby.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03519 Published 2022-04-11 Partial fix · 1.13.4 CWE-1333

TI-2018-15259 CVE-2018-25032 · GHSA-jc36-42cf-vqwj

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if…

HIGH 72

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.51733 Published 2022-03-25 Fixed in 1.13.4 CWE-787

Vulnerabilities

Filters