Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54498view_component: around_render HTML-Safety BypassRubyGems · view_component · fixed in 4.12.0
- CVE-2026-54497view_component: Reused Component Instances Retain Stale Render ContextRubyGems · view_component · fixed in 4.12.0
- CVE-2026-53727css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`RubyGems · css_parser · fixed in 3.0.0
- CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputRubyGems · secure_headers · fixed in 7.3.0
- CVE-2026-54171Excon: redact additional sensitive/risky headers when following redirectsRubyGems · excon · fixed in 1.5.0
- CVE-2026-54465websocket-driver: Memory exhaustion in HTTP header parserRubyGems · websocket-driver · fixed in 0.8.1
- CVE-2026-54463websocket-driver: Memory exhaustion via abuse of protocol length headersRubyGems · websocket-driver · fixed in 0.8.1
- CVE-2026-54464websocket-driver: Resource limit bypass via message compressionRubyGems · websocket-driver · fixed in 0.8.1
- CVE-2026-45363`jwt` (Ruby gem) - empty-key HMAC bypassRubyGems · jwt · fixed in 3.2.0, 2.10.3
- CVE-2026-47736Puma PROXY Protocol v1 Parser Allows Remote Memory ExhaustionRubyGems · puma · fixed in 8.0.2, 7.2.1
- CVE-2026-47737Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent ConnectionsRubyGems · puma · fixed in 8.0.2, 7.2.1
- CVE-2026-44161Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`RubyGems · fluentd · fixed in 1.19.3
- CVE-2026-44160Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`RubyGems · fluentd · fixed in 1.19.3
- CVE-2026-44025Fluentd: Exposure of Sensitive Information via Monitor Agent APIRubyGems · fluentd · fixed in 1.19.3
- CVE-2026-44024Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` PlaceholderRubyGems · fluentd · fixed in 1.19.3
- CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String HandlingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54902Oj: Use-After-Free in Oj::Parser SAJ Long Key CallbackRubyGems · oj · fixed in 3.17.3
- CVE-2026-54901Oj: Use-After-Free in Oj::Parser array_class/hash_class GC MarkingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute HandlingRubyGems · oj · fixed in 3.17.3
- CVE-2026-54898Oj: Use-After-Free in Oj::Parser SAJ Callback via Input MutationRubyGems · oj · fixed in 3.17.3
- CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant CloseRubyGems · oj · fixed in 3.17.3
- CVE-2026-54896Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large IndentRubyGems · oj · fixed in 3.17.3
- CVE-2026-54592Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested InputRubyGems · oj · fixed in 3.17.3
- CVE-2026-54502Oj: Stack Buffer Overflow in Oj.dump via Large IndentRubyGems · oj · fixed in 3.17.3
- CVE-2026-54500Oj: intern.c form_attr has an uninitialized stack readRubyGems · oj · fixed in 3.17.3
- CVE-2026-54899Oj: Use-After-Free in Oj::Parser Symbol Key Cache ToggleRubyGems · oj · fixed in 3.17.2
- CVE-2026-54696Ruby JSON: JSON generator heap buffer overflow when streaming to an IORubyGems · json · fixed in 2.19.9
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude ProcessingRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typeRubyGems · nokogiri · fixed in 1.19.4