733 matches found
Cross-site Scripting (XSS)
Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which uses CGI.unescapeHTML and therefore...
The vulnerability of the Nokogiri library, related to an incorrect limitation on XML links to external objects, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Nokogiri library is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Important Photon OS Security Update - PHSA-2026-4.0-1052
Updates of 'python3-lxml', 'rubygem-concurrent-ruby', 'rubygem-oj', 'python3-pyOpenSSL', 'rubygem-nokogiri' packages of Photon OS have been released...
Important Photon OS Security Update - PHSA-2026-4.0-1051
Updates of 'rubygem-nokogiri' packages of Photon OS have been released...
Important Photon OS Security Update - PHSA-2026-5.0-0911
Updates of 'rubygem-faraday', 'rubygem-nokogiri', 'python3-mistune', 'python3-urllib3' packages of Photon OS have been released...
CVE-2026-57434
A flaw was found in Nokogiri, an open source XML and HTML library for the Ruby programming language. A remote attacker could exploit this vulnerability by calling specific methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This could lead to a NUL...
CVE-2026-57436
A flaw was found in Nokogiri, an open-source library used for processing XML and HTML documents. This vulnerability occurs due to insufficient validation when setting the document's root element, allowing a malicious document to trigger a memory error. This can lead to a heap use-after-free,...
CVE-2026-57235
A flaw was found in Nokogiri, an XML and HTML library for Ruby. This vulnerability allows an attacker to trigger an out-of-bounds read by providing a specially crafted large negative index to certain methods. This can lead to a denial of service DoS by crashing the application on CRuby, or by...
CVE-2026-57435
A flaw was found in Nokogiri, an XML and HTML library for Ruby. This use-after-free vulnerability occurs when replacing the value of an XML attribute. If a Ruby wrapper already points to the attribute's child node, the underlying native child node can be freed while the wrapper remains accessible...
Linux Distros Unpatched Vulnerability : CVE-2026-57236
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Documentencoding= with an invalid encoding e.g., a...
Linux Distros Unpatched Vulnerability : CVE-2026-57234
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default f...
Linux Distros Unpatched Vulnerability : CVE-2026-57435
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri's CRuby native extension could leave a Ruby wrapper...
Linux Distros Unpatched Vulnerability : CVE-2026-57438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by...
Linux Distros Unpatched Vulnerability : CVE-2026-57434
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on...
Linux Distros Unpatched Vulnerability : CVE-2026-57437
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document...
Linux Distros Unpatched Vulnerability : CVE-2026-57235
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet and its alias slice checked the...
Linux Distros Unpatched Vulnerability : CVE-2026-57436
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Documentroot= validated only that the new roo...
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
...