Sources:
amazon_linux
archlinux
azure_linux
bitnami_vulndb
capec
capec_enrichment_dashboard
certeu
certfr
circl_kev
cisa_known_exploited
cna_scorecard
cnvd
csaf_abb
csaf_adstecindustrialitgmbh
csaf_amd
csaf_aumariestergmbhcokg
csaf_baadem2mproductsgmbh
csaf_beckhoffautomationgmbhcokg
csaf_bendergmbhcokg
csaf_bosch
csaf_bsi
csaf_bsi_aggregator
csaf_bsi_cvd_white
csaf_bsi_white
csaf_bsi_wid_white
csaf_carlogavazziautomation
csaf_certbund
csaf_certvde
csaf_cisa
csaf_cisa_it
csaf_cisa_ot
csaf_cisco
csaf_claaskgaa
csaf_codesysgmbh
csaf_dell
csaf_duraggmbh
csaf_endresshauserag
csaf_ericsson
csaf_euchnergmbhcokg
csaf_festosecokg
csaf_frauschersensortechnikgmbh
csaf_hancom
csaf_harmaninternational
csaf_helmholzgmbhcokg
csaf_himapaulhildebrandtgmbh
csaf_hitachi
csaf_hpe
csaf_huawei
csaf_hydacinternationalgmbh
csaf_ibm
csaf_ifmelectronicgmbh
csaf_janitzaelectronicsgmbh
csaf_jumogmbhcokg
csaf_juniper
csaf_kebautomationkg
csaf_kukaag
csaf_lenovo
csaf_lenzese
csaf_mbconnectlinegmbh
csaf_mettlertoledogmbh
csaf_metzconnectgmbh
csaf_microsoft
csaf_mieleciekg
csaf_moxa
csaf_murrelektronikgmbh
csaf_ncscnl
csaf_ndaal
csaf_netapp
csaf_nozomi
csaf_nozominetworks
csaf_nvidia
csaf_opcfoundation
csaf_openeuler
csaf_opensuse
csaf_oracle
csaf_ox
csaf_paloalto
csaf_panasonic
csaf_pentagrid
csaf_pepperlfuchsse
csaf_phoenix
csaf_pilzgmbhcokg
csaf_qnap
csaf_redhat
csaf_samsung
csaf_sauterag
csaf_schneider
csaf_sick
csaf_siemens
csaf_smasolartechnologyag
csaf_suse
csaf_swarcotrafficsystemsgmbh
csaf_synology
csaf_tibco
csaf_trend
csaf_trumpfsecokg
csaf_trustsource
csaf_tuxcare
csaf_ubiquiti
csaf_vartastoragegmbh
csaf_vegagrieshaberkg
csaf_vmware
csaf_wagogmbhcokg
csaf_weidmuellerinterfacegmbhcokg
csaf_welotecgmbh
csaf_wiesemanntheisgmbh
csaf_yaskawaeuropegmbh
csaf_yokogawa
csaf_zyxel
cve_forecast
cve_icu
cve_vs_github_dashboard
cvelistv5
cwe_dashboard
cwe_enrichment
cwec
debian_security_tracker
drupal
emb3d
emb3d_dashboard
epss_dashboard
epss_history
epss_kev_enrichment
euvd_kev
fedora
fkie_nvd
freebsd
gcve
gcve_enriched
gcve_enrichment
gcve_enrichment_dashboard
gentoo
github
gsd
jvn
kev_ransomware
mitre_attack
moksha
ndaal_kev
netbsd
nuclei_dashboard
nuclei_enrichment
nvd
nvd_cpe_dictionary
openbsd
opencve
oracle_linux
ossf_malicious_packages
osv_almalinux
osv_alpine
osv_bellsoft
osv_chainguard
osv_cran
osv_github_actions
osv_golang
osv_haskell
osv_hex
osv_maven
osv_npm
osv_nuget
osv_ocaml
osv_ossfuzz
osv_packagist
osv_pub
osv_rocky
osv_rubygems
osv_rustsec
osv_swift
osv_ubuntu
osv_wolfi
publish_stats
pysec
sadp_pilot
ssvc
ssvc_dashboard
tailscale
tsunami_enrichment
variot
vulnrichment
Clear
| ID | Title | Severity | CVSS | Source | Updated |
|---|---|---|---|---|---|
| mal-2026-16466 | Malicious code in wurl_show_data (RubyGems) | UNKNOWN | osv_rubygems | unknown | |
| mal-2026-16420 | Malicious code in kerokwis (RubyGems) | UNKNOWN | osv_rubygems | unknown | |
| mal-2026-16411 | Malicious code in no-fun (RubyGems) | UNKNOWN | osv_rubygems | unknown | |
| ghsa-7952-gx68-cjqr | MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers | UNKNOWN | 5.3 | ghsa | unknown |
| ghsa-5vvx-3h34-f3gj | MPXJ: XXE Vulnerability in MerlinReader | UNKNOWN | 7.5 | ghsa | unknown |
| ghsa-4825-p4xm-pcf2 | Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) | UNKNOWN | 7.1 | ghsa | unknown |
| ghsa-mqq5-j7w8-2hgh | AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content | UNKNOWN | 7.5 | ghsa | unknown |
| ghsa-mjgf-xj26-9qf9 | pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier | UNKNOWN | 7.4 | ghsa | unknown |
| ghsa-xqqh-3w52-q8p7 | Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute | UNKNOWN | 6.9 | ghsa | unknown |
| ghsa-rh9x-7xjc-vwx2 | Duplicate Advisory: Nokogiri XSLT transform has a memory leak | UNKNOWN | 6.9 | ghsa | unknown |
| ghsa-9hj4-r449-hfvc | Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams | UNKNOWN | ghsa | unknown | |
| ghsa-xr9x-r78c-5hrm | Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | UNKNOWN | 9.5 | ghsa | unknown |
| ghsa-x2f5-4prf-w687 | Ruby json: JSON generator heap buffer overflow when streaming to an IO | UNKNOWN | 3.7 | ghsa | unknown |
| ghsa-cj75-f6xr-r4g7 | Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations | UNKNOWN | 5.1 | ghsa | unknown |
| ghsa-9wjq-cp2p-hrgf | Loofah: SVG `href` attribute bypasses local-reference restriction | UNKNOWN | 4.7 | ghsa | unknown |
| ghsa-8whx-365g-h9vv | Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references | UNKNOWN | 2.3 | ghsa | unknown |
| ghsa-5qhf-9phg-95m2 | Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons | UNKNOWN | 2.3 | ghsa | unknown |
| ghsa-4mrv-5p47-p938 | MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure | UNKNOWN | 2.1 | ghsa | unknown |
| ghsa-xv9w-7v6q-hpjh | fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3` | UNKNOWN | 2.7 | ghsa | unknown |
| ghsa-wfpw-mmfh-qq69 | Nokogiri: Possible Use-After-Free in XInclude Processing | UNKNOWN | ghsa | unknown | |
| ghsa-q2gm-54r6-8fwm | Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation | UNKNOWN | 8.7 | ghsa | unknown |
| ghsa-phwj-rprq-35pp | Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` | UNKNOWN | 1.7 | ghsa | unknown |
| ghsa-p67v-3w7g-wjg7 | Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime | UNKNOWN | 1.7 | ghsa | unknown |
| ghsa-m578-w5vf-rfcm | Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback | UNKNOWN | 8.7 | ghsa | unknown |
| ghsa-c4fp-cxrr-mj66 | Net::IMAP: Denial of Service via incomplete raw argument validation | UNKNOWN | 2.1 | ghsa | unknown |
| ghsa-9ppp-w3g4-fh4q | Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close | UNKNOWN | 8.7 | ghsa | unknown |
| ghsa-8p34-64r3-mwg8 | Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument | UNKNOWN | 5.8 | ghsa | unknown |
| ghsa-8678-w3jw-xfc2 | Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 | UNKNOWN | 2.6 | ghsa | unknown |
| ghsa-5prr-v3j2-97mh | Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` | UNKNOWN | 6.3 | ghsa | unknown |
| ghsa-475m-ph3x-64gp | Oj: Integer Overflow in Oj.load 2GB String Handling | UNKNOWN | 8.7 | ghsa | unknown |