19148 matches found
UBUNTU-CVE-2026-79769
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
UBUNTU-CVE-2026-79771
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...
UBUNTU-CVE-2023-54354
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
PT-2026-85150
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v2fc-qm4h-8hqv. This link is maintained to preserve external references. Original Description Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby...
CVE-2026-79771: Missing Release of Memory after Effective Lifetime
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...
CVE-2026-44476: Improper Authentication
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
MiracleLinux 9 : ruby:3.3 (AXSA:2026-1647:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1647:01 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...
Malicious code in ultra-safe-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-pure-mod (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-max-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-fast-rb (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-sharp-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-pure-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-pro-rb (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-pro-lib (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-max-gem (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in super-quick-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...