# cve.now: Sparklemotion

The newest entries naming Sparklemotion as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-126064](https://cve.now/CVE-2026-126064.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Node#\[\]=\` or \`#lang=\` (CVSS 2.0)
- [CVE-2026-126063](https://cve.now/CVE-2026-126063.md): Nokogiri: Mutation XSS through \`noscript\` content in Nokogiri's HTML5 serializer (CVSS 2.3)
- [CVE-2026-126062](https://cve.now/CVE-2026-126062.md): Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with \`NONET\` set (CVSS 3.7)
- [CVE-2026-107715](https://cve.now/CVE-2026-107715.md): Mechanize sends credential headers to another host after an HTTP redirect (CVSS 6.8)
- [CVE-2026-107714](https://cve.now/CVE-2026-107714.md): Mechanize sends credential headers to a different scheme or port after a redirect (CVSS 5.9)
- [CVE-2026-107399](https://cve.now/CVE-2026-107399.md): Mechanize sends credential headers to another origin after a meta refresh (CVSS 6.8)
- [CVE-2026-79772](https://cve.now/CVE-2026-79772.md): Nokogiri before 1.19.1 Unchecked Return Value canonicalize (CVSS 6.9)
- [CVE-2026-79771](https://cve.now/CVE-2026-79771.md): Nokogiri before 1.19.3 Memory Leak via XSLT Transform (CVSS 6.9)
- [CVE-2026-79770](https://cve.now/CVE-2026-79770.md): Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer (CVSS 8.7)
- [CVE-2026-79769](https://cve.now/CVE-2026-79769.md): Nokogiri before 1.19.4 Invalid Memory Read via initialize\_copy\_with\_args (CVSS 8.7)
- [CVE-2026-54620](https://cve.now/CVE-2026-54620.md): sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks (CVSS 2.0)
- [CVE-2026-54619](https://cve.now/CVE-2026-54619.md): sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity (CVSS 2.0)
- [CVE-2026-57438](https://cve.now/CVE-2026-57438.md): Nokogiri: Possible Use-After-Free in XInclude Processing (CVSS 2.2)
- [CVE-2026-57437](https://cve.now/CVE-2026-57437.md): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime (CVSS 1.7)
- [CVE-2026-57436](https://cve.now/CVE-2026-57436.md): Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type (CVSS 1.7)
- [CVE-2026-57435](https://cve.now/CVE-2026-57435.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\` (CVSS 1.7)
- [CVE-2026-57434](https://cve.now/CVE-2026-57434.md): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (CVSS 1.7)
- [CVE-2026-57235](https://cve.now/CVE-2026-57235.md): Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\` (CVSS 6.3)
- [CVE-2026-57234](https://cve.now/CVE-2026-57234.md): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (CVSS 2.6)
- [CVE-2026-57236](https://cve.now/CVE-2026-57236.md): Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception (CVSS 1.7)
- [CVE-2025-6494](https://cve.now/CVE-2025-6494.md): sparklemotion nokogiri hashmap.c hashmap\_get\_with\_hash heap-based overflow (CVSS 4.8)
- [CVE-2025-6490](https://cve.now/CVE-2025-6490.md): sparklemotion nokogiri hashmap.c hashmap\_set\_with\_hash heap-based overflow (CVSS 4.8)
- [CVE-2022-23476](https://cve.now/CVE-2022-23476.md): Unchecked return value from xmlTextReaderExpand in Nokogiri (CVSS 7.5)
- [CVE-2022-31033](https://cve.now/CVE-2022-31033.md): Authorization header leak in rubygem Mechanize (CVSS 5.9)
- [CVE-2022-29181](https://cve.now/CVE-2022-29181.md): Improper Handling of Unexpected Data Type in Nokogiri (CVSS 8.2)
- [CVE-2022-24839](https://cve.now/CVE-2022-24839.md): Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork) (CVSS 7.5)
- [CVE-2022-24836](https://cve.now/CVE-2022-24836.md): Inefficient Regular Expression Complexity in Nokogiri (CVSS 7.5)
- [CVE-2021-41098](https://cve.now/CVE-2021-41098.md): Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby (CVSS 7.5)
- [CVE-2021-21289](https://cve.now/CVE-2021-21289.md): Command Injection Vulnerability in Mechanize (CVSS 7.4)
- [CVE-2020-26247](https://cve.now/CVE-2020-26247.md): XXE in Nokogiri (CVSS 2.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sparklemotion
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.