https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T22:38:28.603659+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2020-26247 CVE-2020-26247 — XXE in Nokogiri 2026-09-29T22:38:29.188371+00:00

Affected: sparklemotion nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

 https://vulnerability.circl.lu/vuln/usn-7659-1 USN-7659-1 — ruby-nokogiri vulnerabilities 2026-09-29T22:38:29.188492+00:00

Affected: Ubuntu:Pro:20.04:LTS: ruby-nokogiri, Ubuntu:Pro:22.04:LTS: ruby-nokogiri

It was discovered Nokogiri did not correctly parse XML Schemas. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-26247)

Agustin Gianni discovered that Nokogiri did not correctly parse XML and HTML files. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or leak sensitive information. (CVE-2022-29181)