Sparklemotion vulnerabilities

Products

• Nokogiri 19
• Mechanize 5
• Sqlite3-ruby 2

Newest

• python-mechanize mechanize Mechanize sends credential headers to another host after an HTTP redirect CVE-2026-107715 Fix available 6.8 MediumOctober 8, 2026
• python-mechanize mechanize Mechanize sends credential headers to a different scheme or port after a redirect CVE-2026-107714 Fix available 5.9 MediumOctober 8, 2026
• python-mechanize mechanize Mechanize sends credential headers to another origin after a meta refresh CVE-2026-107399 Fix available 6.8 MediumOctober 8, 2026
• sparklemotion nokogiri Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args CVE-2026-79769 Fix available 8.7 HighAugust 25, 2026
• sparklemotion sqlite3-ruby sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks CVE-2026-54620 Fix available 2.0 LowJuly 28, 2026
• sparklemotion sqlite3-ruby sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity CVE-2026-54619 Fix available 2.0 LowJuly 28, 2026
• nokogiri Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` CVE-2026-57435 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free in XInclude Processing CVE-2026-57438 Fix available 2.2 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime CVE-2026-57437 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type CVE-2026-57436 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` CVE-2026-57235 Fix available 6.3 MediumJune 19, 2026
• nokogiri Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes CVE-2026-57434 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 CVE-2026-57234 Fix available 2.6 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception CVE-2026-57236 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri before 1.19.3 Memory Leak via XSLT Transform CVE-2026-79771 Fix available 6.9 MediumMay 6, 2026
• nokogiri Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer CVE-2026-79770 Fix available 8.7 HighMay 6, 2026
• nokogiri Nokogiri before 1.19.1 Unchecked Return Value canonicalize CVE-2026-79772 Fix available 6.9 MediumFebruary 18, 2026
• sparklemotion nokogiri sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow CVE-2025-6494 Disputed 4.8 MediumJune 22, 2025
• sparklemotion nokogiri sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow CVE-2025-6490 Disputed 4.8 MediumJune 22, 2025
• nokogiri Unchecked return value from xmlTextReaderExpand in Nokogiri CVE-2022-23476 Fix available 7.5 HighDecember 8, 2022
• mechanize project mechanize, fedoraproject fedora +1 more Authorization header leak in rubygem Mechanize CVE-2022-31033 Fix available 5.9 MediumJune 9, 2022
• nokogiri, apple macos +1 more Improper Handling of Unexpected Data Type in Nokogiri CVE-2022-29181 Fix available 8.2 HighMay 20, 2022
• nekohtml project nekohtml, oracle weblogic server +1 more Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork) CVE-2022-24839 Fix available 7.5 HighApril 11, 2022
• nokogiri, apple macos, debian linux +1 more +3 more Inefficient Regular Expression Complexity in Nokogiri CVE-2022-24836 Fix available 7.5 HighApril 11, 2022
• nokogiri Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby CVE-2021-41098 Fix available 7.5 HighSeptember 27, 2021
• mechanize project mechanize, debian linux, fedoraproject fedora +2 more Command Injection Vulnerability in Mechanize CVE-2021-21289 Fix available 7.4 HighFebruary 2, 2021
• nokogiri, debian linux +1 more XXE in Nokogiri CVE-2020-26247 Fix available 2.6 LowDecember 30, 2020