Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
43999
Total
3569
Critical
13202
High
13005
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-71407 | CRITICAL | 9.8 | Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during … | Aug 25, 2026 |
| CVE-2025-71406 | HIGH | 7.8 | Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due … | Aug 25, 2026 |
| CVE-2025-71346 | LOW | 2.9 | Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The … | Aug 25, 2026 |
| CVE-2024-58378 | CRITICAL | 9.8 | Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader … | Aug 25, 2026 |
| CVE-2024-58377 | NONE | — | Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to … | Aug 25, 2026 |
| CVE-2023-54354 | HIGH | 7.5 | Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing … | Aug 25, 2026 |
| CVE-2022-51000 | CRITICAL | 9.8 | Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in … | Aug 25, 2026 |
| CVE-2022-50999 | HIGH | 8.6 | Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can … | Aug 25, 2026 |
| CVE-2022-50998 | HIGH | 7.5 | Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle … | Aug 25, 2026 |
| CVE-2021-47996 | HIGH | 7.5 | Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, … | Aug 25, 2026 |
| CVE-2026-79717 | MEDIUM | 6.4 | A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can … | Aug 25, 2026 |
| CVE-2026-70551 | HIGH | 8.5 | A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. | Aug 25, 2026 |
| CVE-2026-69104 | HIGH | 7.6 | An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address … | Aug 25, 2026 |
| CVE-2026-55624 | UNKNOWN | — | MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. … | Aug 25, 2026 |
| CVE-2026-55541 | UNKNOWN | — | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not … | Aug 25, 2026 |
| CVE-2026-55540 | HIGH | 7.1 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can … | Aug 25, 2026 |
| CVE-2026-55538 | HIGH | 7.3 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. … | Aug 25, 2026 |
| CVE-2026-55537 | HIGH | 7.1 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. … | Aug 25, 2026 |
| CVE-2026-55535 | MEDIUM | 6.8 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated … | Aug 25, 2026 |
| CVE-2026-55534 | HIGH | 8.6 | PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST … | Aug 25, 2026 |
| CVE-2026-55531 | MEDIUM | 6.5 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request … | Aug 25, 2026 |
| CVE-2026-55530 | MEDIUM | 6.1 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call … | Aug 25, 2026 |
| CVE-2026-55529 | MEDIUM | 6.9 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches … | Aug 25, 2026 |
| CVE-2026-55528 | HIGH | 8.2 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller … | Aug 25, 2026 |
| CVE-2026-55527 | HIGH | 7.1 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators … | Aug 25, 2026 |