Sparklemotion vulnerabilities
30 CVEs and advisories name Sparklemotion as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-126064Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
- CVE-2026-126063Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
- CVE-2026-126062Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
- CVE-2026-107715Mechanize sends credential headers to another host after an HTTP redirect
- CVE-2026-107714Mechanize sends credential headers to a different scheme or port after a redirect
- CVE-2026-107399Mechanize sends credential headers to another origin after a meta refresh
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalize
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transform
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
- CVE-2026-79769Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
- CVE-2026-54620sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
- CVE-2026-54619sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processing
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
- CVE-2025-6494sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow
- CVE-2025-6490sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow
- CVE-2022-23476Unchecked return value from xmlTextReaderExpand in Nokogiri
- CVE-2022-31033Authorization header leak in rubygem Mechanize
- CVE-2022-29181Improper Handling of Unexpected Data Type in Nokogiri
- CVE-2022-24839Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
- CVE-2022-24836Inefficient Regular Expression Complexity in Nokogiri
- CVE-2021-41098Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- CVE-2021-21289Command Injection Vulnerability in Mechanize
- CVE-2020-26247XXE in Nokogiri