Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-79772 (GCVE-0-2026-79772)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-28 22:24

Title

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Summary

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:24 UTC

CWE

CWE-252 - Unchecked Return Value

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 1.5.1 , < 1.19.1 (semver) Unaffected: 1.19.1 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-02-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:24:35.826683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:24:47.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.1",
              "status": "affected",
              "version": "1.5.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.1",
                  "versionStartIncluding": "1.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:04.400Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wx95-c6cv-8532)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize"
        }
      ],
      "title": "Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79772",
    "datePublished": "2026-08-25T15:16:04.400Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-28T22:24:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79771 (GCVE-0-2026-79771)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-25 17:44

Title

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Summary

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:43 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

Captainjack-kor flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:43:53.409991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:44:08.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Captainjack-kor"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v2fc-qm4h-8hqv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform"
        }
      ],
      "title": "Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79771",
    "datePublished": "2026-08-25T15:16:03.736Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-25T17:44:08.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79770 (GCVE-0-2026-79770)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-09-16 15:51

Title

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Summary

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:10 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

colby-swandale flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:10:25.348193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:27.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colby-swandale"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.059Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c4rq-3m3g-8wgx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
        }
      ],
      "title": "Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79770",
    "datePublished": "2026-08-25T15:16:03.059Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-09-16T15:51:27.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79769 (GCVE-0-2026-79769)

Vulnerability from nvd – Published: 2026-08-25 15:16 – Updated: 2026-08-26 16:11

Title

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Summary

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:58 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.4 (semver) Unaffected: 1.19.4 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-06-18 00:00

Credits

cla7aye15I4nd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:58:51.364011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T16:11:11.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cla7aye15I4nd"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:02.372Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g9g8-vgvw-g3vf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args"
        }
      ],
      "title": "Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79769",
    "datePublished": "2026-08-25T15:16:02.372Z",
    "dateReserved": "2026-08-25T14:29:43.527Z",
    "dateUpdated": "2026-08-26T16:11:11.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71407 (GCVE-0-2025-71407)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24928

Replaced by CVE-2024-56171

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:25.113Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24928",
        "CVE-2024-56171"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71407",
    "datePublished": "2026-08-25T15:15:59.250Z",
    "dateRejected": "2026-09-01T20:33:25.113Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:25.113Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71406 (GCVE-0-2025-71406)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24855

Replaced by CVE-2024-55549

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:45.855Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24855",
        "CVE-2024-55549"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71406",
    "datePublished": "2026-08-25T15:15:58.585Z",
    "dateRejected": "2026-09-01T20:33:45.855Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:45.855Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71346 (GCVE-0-2025-71346)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-32415

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:44.722Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-32415"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71346",
    "datePublished": "2026-08-25T15:15:57.921Z",
    "dateRejected": "2026-09-01T20:33:44.722Z",
    "dateReserved": "2026-06-20T12:48:06.735Z",
    "dateUpdated": "2026-09-01T20:33:44.722Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58378 (GCVE-0-2024-58378)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-25062

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:43.529Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-25062"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58378",
    "datePublished": "2026-08-25T15:15:57.242Z",
    "dateRejected": "2026-09-01T20:33:43.529Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:43.529Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58377 (GCVE-0-2024-58377)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-34459

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:42.399Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-34459"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58377",
    "datePublished": "2026-08-25T15:15:56.569Z",
    "dateRejected": "2026-09-01T20:33:42.399Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:42.399Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54354 (GCVE-0-2023-54354)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2023-28484

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2023-28484"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54354",
    "datePublished": "2026-08-25T15:15:55.858Z",
    "dateRejected": "2026-09-08T14:57:44.514Z",
    "dateReserved": "2026-01-10T01:51:52.987Z",
    "dateUpdated": "2026-09-08T14:57:44.514Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-51000 (GCVE-0-2022-51000)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2021-30560

Replaced by CVE-2022-23308

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.226Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2021-30560",
        "CVE-2022-23308"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-51000",
    "datePublished": "2026-08-25T15:15:55.205Z",
    "dateRejected": "2026-09-08T14:57:44.226Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:44.226Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50999 (GCVE-0-2022-50999)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-29824

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.948Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-29824"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50999",
    "datePublished": "2026-08-25T15:15:54.519Z",
    "dateRejected": "2026-09-08T14:57:43.948Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:43.948Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50998 (GCVE-0-2022-50998)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-40304

Replaced by CVE-2022-40303

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.684Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-40304",
        "CVE-2022-40303"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50998",
    "datePublished": "2026-08-25T15:15:53.830Z",
    "dateRejected": "2026-09-08T14:57:43.684Z",
    "dateReserved": "2026-08-25T14:31:37.341Z",
    "dateUpdated": "2026-09-08T14:57:43.684Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47996 (GCVE-0-2021-47996)

Vulnerability from nvd – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2019-20388

Replaced by CVE-2020-24977

Replaced by CVE-2021-3517

Replaced by CVE-2021-3518

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.412Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2019-20388",
        "CVE-2020-24977",
        "CVE-2021-3517",
        "CVE-2021-3518"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-47996",
    "datePublished": "2026-08-25T15:15:53.158Z",
    "dateRejected": "2026-09-08T14:57:43.412Z",
    "dateReserved": "2026-08-25T14:31:58.552Z",
    "dateUpdated": "2026-09-08T14:57:43.412Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54620 (GCVE-0-2026-54620)

Vulnerability from nvd – Published: 2026-07-28 16:23 – Updated: 2026-07-28 17:27

Title

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 17:26 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sparklemotion/sqlite3-ruby/sec…	x_refsource_CONFIRM
https://github.com/sparklemotion/sqlite3-ruby/pull/711	x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/com…	x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	sqlite3-ruby	Affected: >= 2.1.0, < 2.9.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T17:26:57.162213Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T17:27:04.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sqlite3-ruby",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.9.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T16:23:38.389Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/pull/711",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/pull/711"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5"
        }
      ],
      "source": {
        "advisory": "GHSA-j7fr-3v8c-3qc3",
        "discovery": "UNKNOWN"
      },
      "title": "sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54620",
    "datePublished": "2026-07-28T16:23:38.389Z",
    "dateReserved": "2026-06-15T20:07:02.184Z",
    "dateUpdated": "2026-07-28T17:27:04.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54619 (GCVE-0-2026-54619)

Vulnerability from nvd – Published: 2026-07-28 16:21 – Updated: 2026-07-28 19:33

Title

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Summary

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 19:33 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sparklemotion/sqlite3-ruby/sec…	x_refsource_CONFIRM
https://github.com/sparklemotion/sqlite3-ruby/pull/710	x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/com…	x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/rel…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sparklemotion	sqlite3-ruby	Affected: < 2.9.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:33:22.461590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T19:33:33.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sqlite3-ruby",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T16:21:20.943Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/pull/710",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/pull/710"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033"
        },
        {
          "name": "https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5"
        }
      ],
      "source": {
        "advisory": "GHSA-28hh-pr2h-2w89",
        "discovery": "UNKNOWN"
      },
      "title": "sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54619",
    "datePublished": "2026-07-28T16:21:20.943Z",
    "dateReserved": "2026-06-15T20:07:02.184Z",
    "dateUpdated": "2026-07-28T19:33:33.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79772 (GCVE-0-2026-79772)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-28 22:24

Title

Nokogiri before 1.19.1 Unchecked Return Value canonicalize

Summary

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 22:24 UTC

CWE

CWE-252 - Unchecked Return Value

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 1.5.1 , < 1.19.1 (semver) Unaffected: 1.19.1 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-02-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T22:24:35.826683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T22:24:47.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.1",
              "status": "affected",
              "version": "1.5.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.1",
                  "versionStartIncluding": "1.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:04.400Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wx95-c6cv-8532)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize"
        }
      ],
      "title": "Nokogiri before 1.19.1 Unchecked Return Value canonicalize",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79772",
    "datePublished": "2026-08-25T15:16:04.400Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-28T22:24:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79771 (GCVE-0-2026-79771)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-25 17:44

Title

Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Summary

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:43 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

Captainjack-kor flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:43:53.409991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:44:08.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Captainjack-kor"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v2fc-qm4h-8hqv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform"
        }
      ],
      "title": "Nokogiri before 1.19.3 Memory Leak via XSLT Transform",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79771",
    "datePublished": "2026-08-25T15:16:03.736Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-08-25T17:44:08.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79770 (GCVE-0-2026-79770)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-09-16 15:51

Title

Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Summary

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:10 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.3 (semver) Unaffected: 1.19.3 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-04-27 00:00

Credits

colby-swandale flavorjones

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:10:25.348193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:27.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colby-swandale"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.059Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c4rq-3m3g-8wgx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
        }
      ],
      "title": "Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79770",
    "datePublished": "2026-08-25T15:16:03.059Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-09-16T15:51:27.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79769 (GCVE-0-2026-79769)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-26 16:11

Title

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Summary

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:58 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/sparklemotion/nokogiri/securit…	vendor-advisory
https://www.vulncheck.com/advisories/nokogiri-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
sparklemotion	nokogiri	Affected: 0 , < 1.19.4 (semver) Unaffected: 1.19.4 (semver) cpe:2.3:a:nokogiri:nokogiri::::::::

Date Public

2026-06-18 00:00

Credits

cla7aye15I4nd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:58:51.364011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T16:11:11.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cla7aye15I4nd"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:02.372Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-g9g8-vgvw-g3vf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args"
        }
      ],
      "title": "Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79769",
    "datePublished": "2026-08-25T15:16:02.372Z",
    "dateReserved": "2026-08-25T14:29:43.527Z",
    "dateUpdated": "2026-08-26T16:11:11.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71407 (GCVE-0-2025-71407)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24928

Replaced by CVE-2024-56171

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:25.113Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24928",
        "CVE-2024-56171"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71407",
    "datePublished": "2026-08-25T15:15:59.250Z",
    "dateRejected": "2026-09-01T20:33:25.113Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:25.113Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71406 (GCVE-0-2025-71406)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-24855

Replaced by CVE-2024-55549

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:45.855Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-24855",
        "CVE-2024-55549"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71406",
    "datePublished": "2026-08-25T15:15:58.585Z",
    "dateRejected": "2026-09-01T20:33:45.855Z",
    "dateReserved": "2026-07-18T12:38:41.077Z",
    "dateUpdated": "2026-09-01T20:33:45.855Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71346 (GCVE-0-2025-71346)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2025-32415

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:44.722Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2025-32415"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71346",
    "datePublished": "2026-08-25T15:15:57.921Z",
    "dateRejected": "2026-09-01T20:33:44.722Z",
    "dateReserved": "2026-06-20T12:48:06.735Z",
    "dateUpdated": "2026-09-01T20:33:44.722Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58378 (GCVE-0-2024-58378)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-25062

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:43.529Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-25062"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58378",
    "datePublished": "2026-08-25T15:15:57.242Z",
    "dateRejected": "2026-09-01T20:33:43.529Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:43.529Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58377 (GCVE-0-2024-58377)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-01 20:33

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2024-34459

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:33:42.399Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2024-34459"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58377",
    "datePublished": "2026-08-25T15:15:56.569Z",
    "dateRejected": "2026-09-01T20:33:42.399Z",
    "dateReserved": "2026-08-16T13:02:14.690Z",
    "dateUpdated": "2026-09-01T20:33:42.399Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54354 (GCVE-0-2023-54354)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2023-28484

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.514Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2023-28484"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54354",
    "datePublished": "2026-08-25T15:15:55.858Z",
    "dateRejected": "2026-09-08T14:57:44.514Z",
    "dateReserved": "2026-01-10T01:51:52.987Z",
    "dateUpdated": "2026-09-08T14:57:44.514Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-51000 (GCVE-0-2022-51000)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2021-30560

Replaced by CVE-2022-23308

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:44.226Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2021-30560",
        "CVE-2022-23308"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-51000",
    "datePublished": "2026-08-25T15:15:55.205Z",
    "dateRejected": "2026-09-08T14:57:44.226Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:44.226Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50999 (GCVE-0-2022-50999)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-29824

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.948Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-29824"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50999",
    "datePublished": "2026-08-25T15:15:54.519Z",
    "dateRejected": "2026-09-08T14:57:43.948Z",
    "dateReserved": "2026-08-25T14:31:37.342Z",
    "dateUpdated": "2026-09-08T14:57:43.948Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50998 (GCVE-0-2022-50998)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2022-40304

Replaced by CVE-2022-40303

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.684Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2022-40304",
        "CVE-2022-40303"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2022-50998",
    "datePublished": "2026-08-25T15:15:53.830Z",
    "dateRejected": "2026-09-08T14:57:43.684Z",
    "dateReserved": "2026-08-25T14:31:37.341Z",
    "dateUpdated": "2026-09-08T14:57:43.684Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47996 (GCVE-0-2021-47996)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:15 – Updated: 2026-09-08 14:57

This CVE ID has been rejected as a duplicate.

Replaced by CVE-2019-20388

Replaced by CVE-2020-24977

Replaced by CVE-2021-3517

Replaced by CVE-2021-3518

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-09-08T14:57:43.412Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected as a duplicate."
        }
      ],
      "replacedBy": [
        "CVE-2019-20388",
        "CVE-2020-24977",
        "CVE-2021-3517",
        "CVE-2021-3518"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-47996",
    "datePublished": "2026-08-25T15:15:53.158Z",
    "dateRejected": "2026-09-08T14:57:43.412Z",
    "dateReserved": "2026-08-25T14:31:58.552Z",
    "dateUpdated": "2026-09-08T14:57:43.412Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

68 vulnerabilities by sparklemotion

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)

CVE-2022-51000 (GCVE-0-2022-51000)

CVE-2022-50999 (GCVE-0-2022-50999)

CVE-2022-50998 (GCVE-0-2022-50998)

CVE-2021-47996 (GCVE-0-2021-47996)

CVE-2026-54620 (GCVE-0-2026-54620)

CVE-2026-54619 (GCVE-0-2026-54619)

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)

CVE-2022-51000 (GCVE-0-2022-51000)

CVE-2022-50999 (GCVE-0-2022-50999)

CVE-2022-50998 (GCVE-0-2022-50998)

CVE-2021-47996 (GCVE-0-2021-47996)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

68 vulnerabilities by sparklemotion

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)

CVE-2022-51000 (GCVE-0-2022-51000)

CVE-2022-50999 (GCVE-0-2022-50999)

CVE-2022-50998 (GCVE-0-2022-50998)

CVE-2021-47996 (GCVE-0-2021-47996)

CVE-2026-54620 (GCVE-0-2026-54620)

CVE-2026-54619 (GCVE-0-2026-54619)

CVE-2026-79772 (GCVE-0-2026-79772)

CVE-2026-79771 (GCVE-0-2026-79771)

CVE-2026-79770 (GCVE-0-2026-79770)

CVE-2026-79769 (GCVE-0-2026-79769)

CVE-2025-71407 (GCVE-0-2025-71407)

CVE-2025-71406 (GCVE-0-2025-71406)

CVE-2025-71346 (GCVE-0-2025-71346)

CVE-2024-58378 (GCVE-0-2024-58378)

CVE-2024-58377 (GCVE-0-2024-58377)

CVE-2023-54354 (GCVE-0-2023-54354)

CVE-2022-51000 (GCVE-0-2022-51000)

CVE-2022-50999 (GCVE-0-2022-50999)

CVE-2022-50998 (GCVE-0-2022-50998)

CVE-2021-47996 (GCVE-0-2021-47996)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.