CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

CVE-2026-57435

Nokogiri (Ruby XML/HTML library) had a use-after-free in the CRuby native extension when replacing the value of an XML attribute. If an attribute child node was already accessed, Nokogiri::XML::Attr#value= could free the underlying native child node while a wrapper remained in the document cache,...