Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pasteRubyGems · action_text-trix · fixed in 2.1.18
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsRubyGems · rails-html-sanitizer · fixed in 1.7.1
- CVE-2026-73492Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73491Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73490Loofah: SVG `href` attribute bypasses local-reference restrictionRubyGems · loofah · fixed in 2.25.2
- CVE-2026-73427Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)RubyGems · action_text-trix · fixed in 2.1.18
- CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsRubyGems · json · fixed in 2.21.2
- CVE-2026-45378Decidim: Verification documents can be downloaded through reusable linksRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45573Decidim: Push subscriptions can be abused for server-side requestsRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45572Decidim: HTML content blocks allow stored script executionRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45415Decidim: CSV census record endpoints improper authorizationRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45414Decidim: JWT-backed authentication can be replayed across organizationsRubyGems · decidim · fixed in 0.31.5, 0.32.0
- CVE-2026-45377Decidim: Private exports can be downloaded through reusable linksRubyGems · decidim-core · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45376Decidim: Admin user search allows SQL injection through similarity-based sortingRubyGems · decidim-admin · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45330Decidim: Verification admins can access supplied IDs from other organisationsRubyGems · decidim-verifications · fixed in 0.30.9, 0.31.5, 0.32.0
- CVE-2026-45086Decidim: Forms admin question editor lacks authorizationRubyGems · decidim-demographics · fixed in 0.31.5, 0.32.0
- CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby sourceRubyGems · savon · fixed in 2.17.2
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingRubyGems · activestorage · fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1
- CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer DisclosureRubyGems · msgpack · fixed in 1.8.2
- CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportRubyGems · mcp · fixed in 0.23.0
- CVE-2026-67431MCP Ruby SDK: Ruby SSE Session PoisoningRubyGems · mcp · fixed in 0.23.0
- CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)RubyGems · mcp · fixed in 0.23.0
- CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodRubyGems · mcp · fixed in 0.23.0
- CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionRubyGems · mcp · fixed in 0.23.0
- CVE-2026-54659Pagy I18n locale option is not validated before being used in a file pathRubyGems · pagy · fixed in 43.5.6
- CVE-2026-54603OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostRubyGems · oauth2 · fixed in 2.0.22
- CVE-2026-54605OAuth: Cross-origin token-request redirects can expose signed request metadataRubyGems · oauth · fixed in 1.1.6
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function CallbacksRubyGems · sqlite3, sqlite3-ruby · fixed in 2.9.5
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different ArityRubyGems · sqlite3, sqlite3-ruby · fixed in 2.9.5
- CVE-2026-55518Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege EscalationRubyGems · avo · fixed in 3.32.1, 4.0.0.beta.51