Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-107715 (GCVE-0-2026-107715)

Vulnerability from nvd – Published: 2026-10-08 21:27 – Updated: 2026-10-09 13:22

Title

Mechanize sends credential headers to another host after an HTTP redirect

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 13:22 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107715",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T13:22:03.491703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T13:22:27.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:27:24.651Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-2mwr-xjcg-37j7",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to another host after an HTTP redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107715",
    "datePublished": "2026-10-08T21:27:24.651Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-09T13:22:27.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107714 (GCVE-0-2026-107714)

Vulnerability from nvd – Published: 2026-10-08 21:26 – Updated: 2026-10-09 15:06

Title

Mechanize sends credential headers to a different scheme or port after a redirect

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 15:06 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-319 - Cleartext Transmission of Sensitive Information
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T15:06:36.604518Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:06:49.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:26:16.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43ba"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5jgv-wc2m-xv99",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to a different scheme or port after a redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107714",
    "datePublished": "2026-10-08T21:26:16.092Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-09T15:06:49.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107399 (GCVE-0-2026-107399)

Vulnerability from nvd – Published: 2026-10-08 21:24 – Updated: 2026-10-14 01:21

Title

Mechanize sends credential headers to another origin after a meta refresh

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 01:21 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T01:21:27.011574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T01:21:37.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:24:46.349Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-c6rp-p8xm-4q9f",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to another origin after a meta refresh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107399",
    "datePublished": "2026-10-08T21:24:46.349Z",
    "dateReserved": "2026-10-07T21:07:54.989Z",
    "dateUpdated": "2026-10-14T01:21:37.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79772 (GCVE-0-2026-79772)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-28 22:24

Title

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Summary

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:24 UTC

CWE

CWE-252 - Unchecked Return Value

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 1.5.1 , < 1.19.1 (semver) Unaffected: 1.19.1 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-02-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:24:35.826683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:24:47.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.1",
              "status": "affected",
              "version": "1.5.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.1",
                  "versionStartIncluding": "1.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:04.400Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wx95-c6cv-8532)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize"
        }
      ],
      "title": "Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79772",
    "datePublished": "2026-08-25T15:16:04.400Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-28T22:24:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79771 (GCVE-0-2026-79771)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-25 17:44

Title

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Summary

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:43 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

Captainjack-kor flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:43:53.409991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:44:08.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Captainjack-kor"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v2fc-qm4h-8hqv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform"
        }
      ],
      "title": "Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79771",
    "datePublished": "2026-08-25T15:16:03.736Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-25T17:44:08.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79770 (GCVE-0-2026-79770)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-09-16 15:51

Title

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Summary

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:10 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

colby-swandale flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:10:25.348193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:27.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colby-swandale"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.059Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c4rq-3m3g-8wgx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
        }
      ],
      "title": "Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79770",
    "datePublished": "2026-08-25T15:16:03.059Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-09-16T15:51:27.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79769 (GCVE-0-2026-79769)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-26 16:11

Title

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Summary

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:58 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.4 (semver) Unaffected: 1.19.4 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-06-18 00:00

Credits

cla7aye15I4nd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:58:51.364011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T16:11:11.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cla7aye15I4nd"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:02.372Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g9g8-vgvw-g3vf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args"
        }
      ],
      "title": "Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79769",
    "datePublished": "2026-08-25T15:16:02.372Z",
    "dateReserved": "2026-08-25T14:29:43.527Z",
    "dateUpdated": "2026-08-26T16:11:11.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71407 (GCVE-0-2025-71407)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24928

Replaced by CVE-2024-56171

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:25.113Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24928",
        "CVE-2024-56171"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71407",
    "datePublished": "2026-08-25T15:15:59.250Z",
    "dateRejected": "2026-09-01T20:33:25.113Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:25.113Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71406 (GCVE-0-2025-71406)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24855

Replaced by CVE-2024-55549

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:45.855Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24855",
        "CVE-2024-55549"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71406",
    "datePublished": "2026-08-25T15:15:58.585Z",
    "dateRejected": "2026-09-01T20:33:45.855Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:45.855Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71346 (GCVE-0-2025-71346)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-32415

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:44.722Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-32415"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71346",
    "datePublished": "2026-08-25T15:15:57.921Z",
    "dateRejected": "2026-09-01T20:33:44.722Z",
    "dateReserved": "2026-06-20T12:48:06.735Z",
    "dateUpdated": "2026-09-01T20:33:44.722Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58378 (GCVE-0-2024-58378)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-25062

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:43.529Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-25062"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58378",
    "datePublished": "2026-08-25T15:15:57.242Z",
    "dateRejected": "2026-09-01T20:33:43.529Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:43.529Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58377 (GCVE-0-2024-58377)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-34459

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:42.399Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-34459"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58377",
    "datePublished": "2026-08-25T15:15:56.569Z",
    "dateRejected": "2026-09-01T20:33:42.399Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:42.399Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54354 (GCVE-0-2023-54354)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2023-28484

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2023-28484"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54354",
    "datePublished": "2026-08-25T15:15:55.858Z",
    "dateRejected": "2026-09-08T14:57:44.514Z",
    "dateReserved": "2026-01-10T01:51:52.987Z",
    "dateUpdated": "2026-09-08T14:57:44.514Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-51000 (GCVE-0-2022-51000)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2021-30560

Replaced by CVE-2022-23308

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.226Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2021-30560",
        "CVE-2022-23308"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-51000",
    "datePublished": "2026-08-25T15:15:55.205Z",
    "dateRejected": "2026-09-08T14:57:44.226Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:44.226Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50999 (GCVE-0-2022-50999)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-29824

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.948Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-29824"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50999",
    "datePublished": "2026-08-25T15:15:54.519Z",
    "dateRejected": "2026-09-08T14:57:43.948Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:43.948Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50998 (GCVE-0-2022-50998)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-40304

Replaced by CVE-2022-40303

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.684Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-40304",
        "CVE-2022-40303"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50998",
    "datePublished": "2026-08-25T15:15:53.830Z",
    "dateRejected": "2026-09-08T14:57:43.684Z",
    "dateReserved": "2026-08-25T14:31:37.341Z",
    "dateUpdated": "2026-09-08T14:57:43.684Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47996 (GCVE-0-2021-47996)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2019-20388

Replaced by CVE-2020-24977

Replaced by CVE-2021-3517

Replaced by CVE-2021-3518

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.412Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2019-20388",
        "CVE-2020-24977",
        "CVE-2021-3517",
        "CVE-2021-3518"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-47996",
    "datePublished": "2026-08-25T15:15:53.158Z",
    "dateRejected": "2026-09-08T14:57:43.412Z",
    "dateReserved": "2026-08-25T14:31:58.552Z",
    "dateUpdated": "2026-09-08T14:57:43.412Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107715 (GCVE-0-2026-107715)

Vulnerability from cvelistv5 – Published: 2026-10-08 21:27 – Updated: 2026-10-09 13:22

Title

Mechanize sends credential headers to another host after an HTTP redirect

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 13:22 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107715",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T13:22:03.491703Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T13:22:27.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:27:24.651Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-2mwr-xjcg-37j7",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to another host after an HTTP redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107715",
    "datePublished": "2026-10-08T21:27:24.651Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-09T13:22:27.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107714 (GCVE-0-2026-107714)

Vulnerability from cvelistv5 – Published: 2026-10-08 21:26 – Updated: 2026-10-09 15:06

Title

Mechanize sends credential headers to a different scheme or port after a redirect

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 15:06 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-319 - Cleartext Transmission of Sensitive Information
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T15:06:36.604518Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:06:49.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319: Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:26:16.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/2f97fe358a91928e5e48221f2ec5cb50fa1a43ba"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5jgv-wc2m-xv99",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to a different scheme or port after a redirect"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107714",
    "datePublished": "2026-10-08T21:26:16.092Z",
    "dateReserved": "2026-10-08T17:21:52.975Z",
    "dateUpdated": "2026-10-09T15:06:49.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107399 (GCVE-0-2026-107399)

Vulnerability from cvelistv5 – Published: 2026-10-08 21:24 – Updated: 2026-10-14 01:21

Title

Mechanize sends credential headers to another origin after a meta refresh

Summary

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 01:21 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7630 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/sparklemotion/mechanize/securi…	x_refsource_CONFIRM
https://github.com/sparklemotion/mechanize/pull/676	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/commit…	x_refsource_MISC
https://github.com/sparklemotion/mechanize/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	mechanize	Affected: < 2.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T01:21:27.011574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T01:21:37.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mechanize",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T21:24:46.349Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/pull/676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/pull/676"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3"
        },
        {
          "name": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-c6rp-p8xm-4q9f",
        "discovery": "UNKNOWN"
      },
      "title": "Mechanize sends credential headers to another origin after a meta refresh"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107399",
    "datePublished": "2026-10-08T21:24:46.349Z",
    "dateReserved": "2026-10-07T21:07:54.989Z",
    "dateUpdated": "2026-10-14T01:21:37.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79772 (GCVE-0-2026-79772)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-28 22:24

Title

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Summary

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:24 UTC

CWE

CWE-252 - Unchecked Return Value

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 1.5.1 , < 1.19.1 (semver) Unaffected: 1.19.1 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-02-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:24:35.826683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:24:47.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.1",
              "status": "affected",
              "version": "1.5.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.1",
                  "versionStartIncluding": "1.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:04.400Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wx95-c6cv-8532)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize"
        }
      ],
      "title": "Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79772",
    "datePublished": "2026-08-25T15:16:04.400Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-28T22:24:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79771 (GCVE-0-2026-79771)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-25 17:44

Title

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Summary

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:43 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

Captainjack-kor flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:43:53.409991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:44:08.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Captainjack-kor"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v2fc-qm4h-8hqv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform"
        }
      ],
      "title": "Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79771",
    "datePublished": "2026-08-25T15:16:03.736Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-25T17:44:08.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79770 (GCVE-0-2026-79770)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-09-16 15:51

Title

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Summary

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:10 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

colby-swandale flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:10:25.348193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:27.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colby-swandale"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.059Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c4rq-3m3g-8wgx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
        }
      ],
      "title": "Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79770",
    "datePublished": "2026-08-25T15:16:03.059Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-09-16T15:51:27.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79769 (GCVE-0-2026-79769)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-26 16:11

Title

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Summary

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:58 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6635 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.4 (semver) Unaffected: 1.19.4 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-06-18 00:00

Credits

cla7aye15I4nd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:58:51.364011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T16:11:11.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cla7aye15I4nd"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:02.372Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g9g8-vgvw-g3vf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args"
        }
      ],
      "title": "Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79769",
    "datePublished": "2026-08-25T15:16:02.372Z",
    "dateReserved": "2026-08-25T14:29:43.527Z",
    "dateUpdated": "2026-08-26T16:11:11.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71407 (GCVE-0-2025-71407)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24928

Replaced by CVE-2024-56171

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:25.113Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24928",
        "CVE-2024-56171"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71407",
    "datePublished": "2026-08-25T15:15:59.250Z",
    "dateRejected": "2026-09-01T20:33:25.113Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:25.113Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71406 (GCVE-0-2025-71406)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24855

Replaced by CVE-2024-55549

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:45.855Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24855",
        "CVE-2024-55549"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71406",
    "datePublished": "2026-08-25T15:15:58.585Z",
    "dateRejected": "2026-09-01T20:33:45.855Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:45.855Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71346 (GCVE-0-2025-71346)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-32415

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:44.722Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-32415"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71346",
    "datePublished": "2026-08-25T15:15:57.921Z",
    "dateRejected": "2026-09-01T20:33:44.722Z",
    "dateReserved": "2026-06-20T12:48:06.735Z",
    "dateUpdated": "2026-09-01T20:33:44.722Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58378 (GCVE-0-2024-58378)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-25062

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:43.529Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-25062"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58378",
    "datePublished": "2026-08-25T15:15:57.242Z",
    "dateRejected": "2026-09-01T20:33:43.529Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:43.529Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58377 (GCVE-0-2024-58377)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-34459

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:42.399Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-34459"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58377",
    "datePublished": "2026-08-25T15:15:56.569Z",
    "dateRejected": "2026-09-01T20:33:42.399Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:42.399Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54354 (GCVE-0-2023-54354)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2023-28484

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2023-28484"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54354",
    "datePublished": "2026-08-25T15:15:55.858Z",
    "dateRejected": "2026-09-08T14:57:44.514Z",
    "dateReserved": "2026-01-10T01:51:52.987Z",
    "dateUpdated": "2026-09-08T14:57:44.514Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

74 vulnerabilities by sparklemotion

CVE-2026-107715 (GCVE-0-2026-107715)

CVE-2026-107714 (GCVE-0-2026-107714)

CVE-2026-107399 (GCVE-0-2026-107399)

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)

CVE-2022-51000 (GCVE-0-2022-51000)

CVE-2022-50999 (GCVE-0-2022-50999)

CVE-2022-50998 (GCVE-0-2022-50998)

CVE-2021-47996 (GCVE-0-2021-47996)

CVE-2026-107715 (GCVE-0-2026-107715)

CVE-2026-107714 (GCVE-0-2026-107714)

CVE-2026-107399 (GCVE-0-2026-107399)

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)