Security advisories

low2026-06-19

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

sparklemotion/nokogiri · GHSA-wjv4-x9w8-wm3h

medium2026-06-19

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

sparklemotion/nokogiri · GHSA-5prr-v3j2-97mh

low2026-06-19

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

sparklemotion/nokogiri · GHSA-9cv2-cfxc-v4v2

low2026-06-19

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

sparklemotion/nokogiri · GHSA-8678-w3jw-xfc2

low2026-06-19

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

sparklemotion/nokogiri · GHSA-5v8h-3h3q-446p

high2026-06-19

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

opentofu/opentofu · GHSA-q7j3-v8qv-22vq

high2026-06-19

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

ruvnet/agentic-flow · GHSA-vcv2-r9jh-99m5

high2026-06-19

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

q00/ouroboros · GHSA-jv2h-4p9v-wf5w

medium2026-06-19

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

jupyterlab/jupyterlab · GHSA-vmhf-c436-hxj4

medium2026-06-19

DotVVM: Unrestricted file upload

riganti/dotvvm · GHSA-2rm3-333w-xvc4

critical2026-06-19

DotVVM: Missing authorization in AuthorizeActionFilter

riganti/dotvvm · GHSA-c8qj-jx8j-fg2w

high2026-06-19

ReDoS in DotVVM routing

riganti/dotvvm · GHSA-c2g3-c4gc-w5wg

high2026-06-19

agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

naranor/agent-coderag · GHSA-wg5p-8h9p-3mr7

medium2026-06-19

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

entireio/cli · GHSA-2h46-9x5w-4wf7

high2026-06-19

parse-server: Denial of service via exponential-time processing of deeply nested query operators

parse-community/parse-server · GHSA-cgxm-vr2f-6fj8

high2026-06-19

CVE-2026-12530-Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

aws/bedrock-agentcore-sdk-python · GHSA-6rfw-mq36-jm8h

medium2026-06-19

CVE-2026-55832-tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

sonos/tract · GHSA-h668-6x6g-f8r5

high2026-06-19

CVE-2026-55773-CedarJava has policy injection vulnerability

cedar-policy/cedar-java · GHSA-qmch-v2q9-wg4p

high2026-06-19

CVE-2026-55772-CedarJava has type confusion vulnerability

cedar-policy/cedar-java · GHSA-93g4-m6xv-cmvr

medium2026-06-19

CVE-2026-55767-guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

guzzle/guzzle · GHSA-cwxw-98qj-8qjx