Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classesRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247RubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionRubyGems · nokogiri · fixed in 1.19.4
- CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersRubyGems · faraday · fixed in 2.14.3, 1.10.6
- CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionRubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-54904concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`RubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityRubyGems · concurrent-ruby · fixed in 1.3.7
- CVE-2026-47242Net::IMAP: Command Injection via ID command argumentRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-47240Net::IMAP: Command Injection via non-synchronizing literal in "raw" argumentRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-47241Net::IMAP: Denial of Service via incomplete raw argument validationRubyGems · net-imap · fixed in 0.6.4.1, 0.5.15
- CVE-2026-49342YARD static cache reads raw traversal paths before router sanitizationRubyGems · yard · fixed in 0.9.44
- CVE-2026-12515Katello: missing repository authorization in content_uploads exposes cross-product content existenceRubyGems · katello · fixed in 4.21.0.rc1
- CVE-2026-44587CarrierWave has a denylisted_content_type bypass via Unescaped Regex MetacharactersRubyGems · carrierwave · fixed in 3.1.3, 2.2.7
- CVE-2026-44836view_component: Preview Route Can Dispatch Inherited Helper MethodsRubyGems · view_component · fixed in 4.9.0
- CVE-2026-44837view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeRubyGems · view_component · fixed in 4.9.0
- CVE-2026-40295Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout HandlerRubyGems · devise · fixed in 5.0.4
- CVE-2026-33637Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)RubyGems · faraday · fixed in 2.14.2
- CVE-2026-44511Katalyst Koi: Session cookies can be replayed after user logoutRubyGems · katalyst-koi · fixed in 4.20.0, 5.6.0
- CVE-2026-44312css_parser allows to MITM included https css urlsRubyGems · css_parser · fixed in 2.1.0, 1.22.0
- CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42256net-imap: Denial of service via high iteration count for `SCRAM-*` authenticationRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42245net-imap: Quadratic complexity when reading response literalsRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24
- CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingRubyGems · net-imap · fixed in 0.6.4, 0.5.14, 0.4.24 and more
- CVE-2026-42205Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across ResourcesRubyGems · avo · fixed in 3.31.2
- CVE-2026-41493yard: Possible arbitrary path traversal and file access via yard serverRubyGems · yard · fixed in 0.9.42
- CVE-2025-67202Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craftRubyGems · sidekiq-cron · fixed in 2.4.0
- CVE-2026-42088OpenC3 COSMOS: Administrative Actions via the Script Runner ToolRubyGems · openc3 · fixed in 7.0.0-rc3