{"url":"http://public2.vulnerablecode.io/api/packages/89398?format=json","purl":"pkg:gem/nokogiri@1.0.1","type":"gem","namespace":"","name":"nokogiri","version":"1.0.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.19.3","latest_non_vulnerable_version":"1.19.3","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/5985?format=json","vulnerability_id":"VCID-12ee-na2t-6kg5","summary":"multiple issues","references":[{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7595","reference_id":"","reference_type":"","scores":[{"value":"0.00476","scoring_system":"epss","scoring_elements":"0.65205","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-7595"},{"reference_url":"https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1992","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1992"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/"},{"reference_url":"https://security.gentoo.org/glsa/202010-04","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://security.gentoo.org/glsa/202010-04"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200702-0005","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20200702-0005"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200702-0005/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://security.netapp.com/advisory/ntap-20200702-0005/"},{"reference_url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08"},{"reference_url":"https://usn.ubuntu.com/4274-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4274-1"},{"reference_url":"https://usn.ubuntu.com/4274-1/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://usn.ubuntu.com/4274-1/"},{"reference_url":"https://www.oracle.com/security-alerts/cpuapr2022.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"reference_url":"https://www.oracle.com/security-alerts/cpujul2020.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://www.oracle.com/security-alerts/cpujul2020.html"},{"reference_url":"https://www.oracle.com/security-alerts/cpujul2022.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"reference_url":"https://www.oracle.com/security-alerts/cpuoct2021.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","reference_id":"545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","reference_id":"5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582","reference_id":"949582","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582"},{"reference_url":"https://security.archlinux.org/ASA-202011-15","reference_id":"ASA-202011-15","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202011-15"},{"reference_url":"https://security.archlinux.org/AVG-1263","reference_id":"AVG-1263","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1263"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","reference_id":"CVE-2020-7595","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml","reference_id":"CVE-2020-7595.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml"},{"reference_url":"https://github.com/advisories/GHSA-7553-jr98-vx47","reference_id":"GHSA-7553-jr98-vx47","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7553-jr98-vx47"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","reference_id":"JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/74677?format=json","purl":"pkg:gem/nokogiri@1.10.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.8"}],"aliases":["CVE-2020-7595","GHSA-7553-jr98-vx47"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-12ee-na2t-6kg5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10492?format=json","vulnerability_id":"VCID-1h5h-pvc7-9yhh","summary":"XML Document Root Element Handling Memory Consumption Remote DoS\nThis package contains a flaw that is triggered when handling a root element in an XML document. This may allow a remote attacker to cause a consumption of memory resources.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/1087","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/pull/1087"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50742?format=json","purl":"pkg:gem/nokogiri@1.6.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.3"}],"aliases":["OSVDB-118481"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1h5h-pvc7-9yhh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/192032?format=json","vulnerability_id":"VCID-1ks1-3a4g-eqe7","summary":"","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23476","reference_id":"","reference_type":"","scores":[{"value":"0.00257","scoring_system":"epss","scoring_elements":"0.49221","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-23476"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/"}],"url":"https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/"}],"url":"https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153279","reference_id":"2153279","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153279"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23476","reference_id":"CVE-2022-23476","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23476"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml","reference_id":"CVE-2022-23476.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml"},{"reference_url":"https://github.com/advisories/GHSA-qv4q-mr5r-qprj","reference_id":"GHSA-qv4q-mr5r-qprj","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qv4q-mr5r-qprj"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj","reference_id":"GHSA-qv4q-mr5r-qprj","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/"}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj"},{"reference_url":"https://security.gentoo.org/glsa/202408-13","reference_id":"GLSA-202408-13","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/202408-13"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/80202?format=json","purl":"pkg:gem/nokogiri@1.13.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.10"}],"aliases":["CVE-2022-23476","GHSA-qv4q-mr5r-qprj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1ks1-3a4g-eqe7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83727?format=json","vulnerability_id":"VCID-1ksa-wbqf-j7fu","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6460","reference_id":"","reference_type":"","scores":[{"value":"0.02521","scoring_system":"epss","scoring_elements":"0.8567","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6460"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"},{"reference_url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA"},{"reference_url":"https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513"},{"reference_url":"https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/"},{"reference_url":"http://www.openwall.com/lists/oss-security/2013/12/27/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2013/12/27/2"},{"reference_url":"https://access.redhat.com/security/cve/cve-2013-6460","reference_id":"CVE-2013-6460","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/security/cve/cve-2013-6460"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6460","reference_id":"CVE-2013-6460","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6460"},{"reference_url":"https://security-tracker.debian.org/tracker/CVE-2013-6460","reference_id":"CVE-2013-6460","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security-tracker.debian.org/tracker/CVE-2013-6460"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml","reference_id":"CVE-2013-6460.YML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml"},{"reference_url":"https://github.com/advisories/GHSA-62qp-3fxm-9wxf","reference_id":"GHSA-62qp-3fxm-9wxf","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-62qp-3fxm-9wxf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76766?format=json","purl":"pkg:gem/nokogiri@1.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11"},{"url":"http://public2.vulnerablecode.io/api/packages/51390?format=json","purl":"pkg:gem/nokogiri@1.6.0.rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-1ksa-wbqf-j7fu"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-ajrr-ueqy-2bam"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/76764?format=json","purl":"pkg:gem/nokogiri@1.6.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1"}],"aliases":["CVE-2013-6460","GHSA-62qp-3fxm-9wxf","OSV-101179"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1ksa-wbqf-j7fu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10787?format=json","vulnerability_id":"VCID-2ub7-t6nu-syfs","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nHeap-based buffer overflow in the xmlGROW function in parser.c in libxml2 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-2549.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-2549.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7499","reference_id":"","reference_type":"","scores":[{"value":"0.00714","scoring_system":"epss","scoring_elements":"0.72664","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7499"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281925","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281925"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da"},{"reference_url":"https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM"},{"reference_url":"https://security.gentoo.org/glsa/201701-37","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201701-37"},{"reference_url":"https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509"},{"reference_url":"https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243"},{"reference_url":"http://www.debian.org/security/2015/dsa-3430","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2015/dsa-3430"},{"reference_url":"http://www.ubuntu.com/usn/USN-2834-1","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2834-1"},{"reference_url":"http://xmlsoft.org/news.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://xmlsoft.org/news.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7499","reference_id":"CVE-2015-7499","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7499"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml","reference_id":"CVE-2015-7499.YML","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml"},{"reference_url":"https://github.com/advisories/GHSA-jxjr-5h69-qw3w","reference_id":"GHSA-jxjr-5h69-qw3w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jxjr-5h69-qw3w"},{"reference_url":"https://usn.ubuntu.com/2834-1/","reference_id":"USN-2834-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2834-1/"},{"reference_url":"https://usn.ubuntu.com/2875-1/","reference_id":"USN-2875-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2875-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51392?format=json","purl":"pkg:gem/nokogiri@1.6.7.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.2"},{"url":"http://public2.vulnerablecode.io/api/packages/95470?format=json","purl":"pkg:gem/nokogiri@1.6.8.rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8.rc1"}],"aliases":["CVE-2015-7499","GHSA-jxjr-5h69-qw3w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2ub7-t6nu-syfs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/340680?format=json","vulnerability_id":"VCID-4yvf-h1z3-nfd7","summary":"Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/720","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"},{"reference_url":"https://github.com/advisories/GHSA-r95h-9x8f-r3f7","reference_id":"GHSA-r95h-9x8f-r3f7","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r95h-9x8f-r3f7"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7","reference_id":"GHSA-r95h-9x8f-r3f7","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml","reference_id":"GHSA-r95h-9x8f-r3f7.yml","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/81010?format=json","purl":"pkg:gem/nokogiri@1.16.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.5"}],"aliases":["GHSA-r95h-9x8f-r3f7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4yvf-h1z3-nfd7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/345931?format=json","vulnerability_id":"VCID-6b72-3exf-qfhs","summary":"Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415\n## Summary\n\nNokogiri v1.18.8 upgrades its dependency libxml2 to\n[v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).\n\nlibxml2 v2.13.8 addresses:\n\n- CVE-2025-32414\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889\n- CVE-2025-32415\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890\n\n## Impact\n\n### CVE-2025-32414: No impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds\nmemory access can occur in the Python API (Python bindings) because\nof an incorrect return value. This occurs in xmlPythonFileRead and\nxmlPythonFileReadRaw because of a difference between bytes and characters.\n\n**There is no impact** from this CVE for Nokogiri users.\n\n### CVE-2025-32415: Low impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2,\nxmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer\nunder-read. To exploit this, a crafted XML document must be validated\nagainst an XML schema with certain identity constraints, or a\ncrafted XML schema must be used.\n\nIn the upstream issue, further context is provided by the maintainer:\n\n> The bug affects validation against untrusted XML Schemas (.xsd)\n> and validation of untrusted documents against trusted Schemas if\n> they make use of xsd:keyref in combination with recursively\n> defined types that have additional identity constraints.\n\nMITRE has published a severity score of 2.9 LOW\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/166218?format=json","purl":"pkg:gem/nokogiri@1.18.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.8"}],"aliases":["GHSA-5w6v-399v-w3cc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6b72-3exf-qfhs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/2819?format=json","vulnerability_id":"VCID-8274-u9e9-uufm","summary":"arbitrary code execution","references":[{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4658","reference_id":"","reference_type":"","scores":[{"value":"0.15391","scoring_system":"epss","scoring_elements":"0.94756","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4658"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.1","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:H/Au:N/C:P/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1615","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1615"},{"reference_url":"https://security.gentoo.org/glsa/201701-37","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201701-37"},{"reference_url":"https://support.apple.com/HT207141","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT207141"},{"reference_url":"https://support.apple.com/HT207142","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT207142"},{"reference_url":"https://support.apple.com/HT207143","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT207143"},{"reference_url":"https://support.apple.com/HT207170","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT207170"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553","reference_id":"840553","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553"},{"reference_url":"https://security.archlinux.org/ASA-201611-2","reference_id":"ASA-201611-2","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201611-2"},{"reference_url":"https://security.archlinux.org/AVG-56","reference_id":"AVG-56","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-56"},{"reference_url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html","reference_id":"CVE-2016-4448.HTML","reference_type":"","scores":[],"url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4658","reference_id":"CVE-2016-4658","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4658"},{"reference_url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html","reference_id":"CVE-2016-4658.HTML","reference_type":"","scores":[],"url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html"},{"reference_url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html","reference_id":"CVE-2016-5131.HTML","reference_type":"","scores":[],"url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html"},{"reference_url":"https://github.com/advisories/GHSA-fr52-4hqw-p27f","reference_id":"GHSA-fr52-4hqw-p27f","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fr52-4hqw-p27f"},{"reference_url":"https://usn.ubuntu.com/3235-1/","reference_id":"USN-3235-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3235-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51850?format=json","purl":"pkg:gem/nokogiri@1.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1"}],"aliases":["CVE-2016-4658","GHSA-fr52-4hqw-p27f"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8274-u9e9-uufm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10762?format=json","vulnerability_id":"VCID-94b6-kg9t-fbee","summary":"Unsafe parsing of unclosed comments\nParsing an unclosed comment can result in `Conditional jump or move depends on uninitialised value(s)` and unsafe memory access.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22"},{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4"},{"reference_url":"https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51279?format=json","purl":"pkg:gem/nokogiri@1.6.6.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4"},{"url":"http://public2.vulnerablecode.io/api/packages/51280?format=json","purl":"pkg:gem/nokogiri@1.6.7.rc4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4"}],"aliases":["GMS-2015-43"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-94b6-kg9t-fbee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10793?format=json","vulnerability_id":"VCID-94mh-kks8-4yf4","summary":"Vulnerabilities in libxml2\nSeveral vulnerabilities were discovered in the libxml2 library that this package gem depends on.","references":[{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html"},{"reference_url":"http://marc.info/?l=bugtraq&m=145382616617563&w=2","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://marc.info/?l=bugtraq&m=145382616617563&w=2"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-2549.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-2549.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5312","reference_id":"","reference_type":"","scores":[{"value":"0.01078","scoring_system":"epss","scoring_elements":"0.78121","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5312"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1276693","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1276693"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5"},{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/1378","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/pull/1378"},{"reference_url":"https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"},{"reference_url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172"},{"reference_url":"https://security.gentoo.org/glsa/201701-37","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201701-37"},{"reference_url":"https://support.apple.com/HT206166","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206166"},{"reference_url":"https://support.apple.com/HT206167","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206167"},{"reference_url":"https://support.apple.com/HT206168","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206168"},{"reference_url":"https://support.apple.com/HT206169","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206169"},{"reference_url":"http://www.debian.org/security/2015/dsa-3430","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2015/dsa-3430"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"},{"reference_url":"http://www.ubuntu.com/usn/USN-2834-1","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2834-1"},{"reference_url":"http://xmlsoft.org/news.html","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://xmlsoft.org/news.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5312","reference_id":"CVE-2015-5312","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5312"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml","reference_id":"CVE-2015-5312.YML","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml"},{"reference_url":"https://github.com/advisories/GHSA-xjqg-9jvg-fgx2","reference_id":"GHSA-xjqg-9jvg-fgx2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xjqg-9jvg-fgx2"},{"reference_url":"https://usn.ubuntu.com/2834-1/","reference_id":"USN-2834-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2834-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51389?format=json","purl":"pkg:gem/nokogiri@1.6.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.1"}],"aliases":["CVE-2015-5312","GHSA-xjqg-9jvg-fgx2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-94mh-kks8-4yf4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/2202?format=json","vulnerability_id":"VCID-9mh9-rax2-1bbb","summary":"multiple issues","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2017:3401","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2017:3401"},{"reference_url":"https://access.redhat.com/errata/RHSA-2018:0287","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2018:0287"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-15412","reference_id":"","reference_type":"","scores":[{"value":"0.02535","scoring_system":"epss","scoring_elements":"0.85707","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-15412"},{"reference_url":"https://bugzilla.gnome.org/show_bug.cgi?id=783160","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.gnome.org/show_bug.cgi?id=783160"},{"reference_url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html"},{"reference_url":"https://crbug.com/727039","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://crbug.com/727039"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1714","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1714"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html"},{"reference_url":"https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348"},{"reference_url":"https://www.debian.org/security/2018/dsa-4086","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4086"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790","reference_id":"883790","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790"},{"reference_url":"https://security.archlinux.org/ASA-201712-5","reference_id":"ASA-201712-5","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201712-5"},{"reference_url":"https://security.archlinux.org/AVG-544","reference_id":"AVG-544","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-544"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412","reference_id":"CVE-2017-15412","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412"},{"reference_url":"https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html","reference_id":"CVE-2017-15412.HTML","reference_type":"","scores":[],"url":"https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html"},{"reference_url":"https://security.gentoo.org/glsa/201801-03","reference_id":"GLSA-201801-03","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201801-03"},{"reference_url":"https://usn.ubuntu.com/3513-1/","reference_id":"USN-3513-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3513-1/"},{"reference_url":"https://usn.ubuntu.com/3513-2/","reference_id":"USN-3513-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3513-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54339?format=json","purl":"pkg:gem/nokogiri@1.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2"}],"aliases":["CVE-2017-15412","GHSA-r58r-74gx-6wx3"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9mh9-rax2-1bbb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13761?format=json","vulnerability_id":"VCID-9psz-qfqt-e3fs","summary":"Improper Input Validation\nIn `numbers.c` in libxslt, which is used by nokogiri, an `xsl:number` with certain format strings could lead to an uninitialized read in `xsltNumberFormatInsertNumbers`. This could allow an attacker to discern whether a byte on the stack contains the characters `[AaIi0]`, or any other character.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13117","reference_id":"","reference_type":"","scores":[{"value":"0.04376","scoring_system":"epss","scoring_elements":"0.89144","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13117"},{"reference_url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1943","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1943"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"},{"reference_url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ"},{"reference_url":"https://oss-fuzz.com/testcase-detail/5631739747106816","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://oss-fuzz.com/testcase-detail/5631739747106816"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190806-0004","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20190806-0004"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200122-0003","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20200122-0003"},{"reference_url":"https://usn.ubuntu.com/4164-1","reference_id":"","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4164-1"},{"reference_url":"https://www.oracle.com/security-alerts/cpujan2020.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/11/17/2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"http://www.openwall.com/lists/oss-security/2019/11/17/2"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321","reference_id":"931321","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117","reference_id":"CVE-2019-13117","reference_type":"","scores":[{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13117"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","reference_id":"IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190806-0004/","reference_id":"ntap-20190806-0004","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://security.netapp.com/advisory/ntap-20190806-0004/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200122-0003/","reference_id":"ntap-20200122-0003","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://security.netapp.com/advisory/ntap-20200122-0003/"},{"reference_url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","reference_id":"r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","reference_id":"rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://usn.ubuntu.com/4164-1/","reference_id":"USN-4164-1","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/"}],"url":"https://usn.ubuntu.com/4164-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57262?format=json","purl":"pkg:gem/nokogiri@1.10.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5"}],"aliases":["CVE-2019-13117","GHSA-4hm9-844j-jmxp"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9psz-qfqt-e3fs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13528?format=json","vulnerability_id":"VCID-9xty-6acy-mub7","summary":"Bypass of a protection mechanism in libxslt\nThe libxslt binary, which is included in nokogiri, allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a -1 error code. `xsltCheckRead` can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11068","reference_id":"","reference_type":"","scores":[{"value":"0.01127","scoring_system":"epss","scoring_elements":"0.7861","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11068"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1892","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1892"},{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/1898","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/pull/1898"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191017-0001","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20191017-0001"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191017-0001/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://security.netapp.com/advisory/ntap-20191017-0001/"},{"reference_url":"https://usn.ubuntu.com/3947-1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3947-1"},{"reference_url":"https://usn.ubuntu.com/3947-1/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://usn.ubuntu.com/3947-1/"},{"reference_url":"https://usn.ubuntu.com/3947-2","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3947-2"},{"reference_url":"https://usn.ubuntu.com/3947-2/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://usn.ubuntu.com/3947-2/"},{"reference_url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/04/22/1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://www.openwall.com/lists/oss-security/2019/04/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/04/23/5","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"http://www.openwall.com/lists/oss-security/2019/04/23/5"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/","reference_id":"36TEYN37XCCKN2XUMRTBBW67BPNMSW4K","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895","reference_id":"926895","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11068","reference_id":"CVE-2019-11068","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11068"},{"reference_url":"https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068","reference_id":"CVE-2019-11068","reference_type":"","scores":[],"url":"https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068"},{"reference_url":"https://security-tracker.debian.org/tracker/CVE-2019-11068","reference_id":"CVE-2019-11068","reference_type":"","scores":[],"url":"https://security-tracker.debian.org/tracker/CVE-2019-11068"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml","reference_id":"CVE-2019-11068.YML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/","reference_id":"GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/"},{"reference_url":"https://github.com/advisories/GHSA-qxcg-xjjg-66mj","reference_id":"GHSA-qxcg-xjjg-66mj","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qxcg-xjjg-66mj"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/","reference_id":"SK4YNISS22MJY22YX5I6V2U63QZAUEHA","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76921?format=json","purl":"pkg:gem/nokogiri@1.10.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.3"},{"url":"http://public2.vulnerablecode.io/api/packages/56778?format=json","purl":"pkg:gem/nokogiri@1.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4"}],"aliases":["CVE-2019-11068","GHSA-qxcg-xjjg-66mj"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9xty-6acy-mub7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83728?format=json","vulnerability_id":"VCID-ajrr-ueqy-2bam","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6461","reference_id":"","reference_type":"","scores":[{"value":"0.02046","scoring_system":"epss","scoring_elements":"0.8414","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6461"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90059","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90059"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA"},{"reference_url":"https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513"},{"reference_url":"http://www.openwall.com/lists/oss-security/2013/12/27/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2013/12/27/2"},{"reference_url":"https://access.redhat.com/security/cve/cve-2013-6461","reference_id":"CVE-2013-6461","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/security/cve/cve-2013-6461"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6461","reference_id":"CVE-2013-6461","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6461"},{"reference_url":"https://security-tracker.debian.org/tracker/CVE-2013-6461","reference_id":"CVE-2013-6461","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security-tracker.debian.org/tracker/CVE-2013-6461"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml","reference_id":"CVE-2013-6461.YML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml"},{"reference_url":"https://github.com/advisories/GHSA-jmhh-w7xp-wg39","reference_id":"GHSA-jmhh-w7xp-wg39","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jmhh-w7xp-wg39"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76766?format=json","purl":"pkg:gem/nokogiri@1.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11"},{"url":"http://public2.vulnerablecode.io/api/packages/51390?format=json","purl":"pkg:gem/nokogiri@1.6.0.rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-1ksa-wbqf-j7fu"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-ajrr-ueqy-2bam"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/76764?format=json","purl":"pkg:gem/nokogiri@1.6.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1"}],"aliases":["CVE-2013-6461","GHSA-jmhh-w7xp-wg39","OSV-101458"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ajrr-ueqy-2bam"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17320?format=json","vulnerability_id":"VCID-arq2-c738-tugt","summary":"Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs\n### Summary\n\nNokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to [v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.\n\nlibxml2 v2.10.4 addresses the following known vulnerabilities:\n\n- [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of empty dict strings isn't deterministic\n- [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref in xmlSchemaFixupComplexType\n- Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.\n\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.14.3`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these same issues.\n\n\n### Impact\n\nNo public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.\n\nThe commits can be examined at:\n\n- [[CVE-2023-29469] Hashing of empty dict strings isn't deterministic (09a2dd45) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64)\n- [[CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType (647e072e) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)\n- [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)","references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4"},{"reference_url":"https://github.com/advisories/GHSA-pxvg-2qj5-37jq","reference_id":"GHSA-pxvg-2qj5-37jq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-pxvg-2qj5-37jq"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq","reference_id":"GHSA-pxvg-2qj5-37jq","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/63408?format=json","purl":"pkg:gem/nokogiri@1.14.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.14.3"}],"aliases":["GHSA-pxvg-2qj5-37jq","GMS-2023-1115"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-arq2-c738-tugt"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/345937?format=json","vulnerability_id":"VCID-e37h-xnn4-hbcn","summary":"Nokogiri patches vendored libxml2 to resolve multiple CVEs\n## Summary\n\nNokogiri v1.18.9 patches the vendored libxml2 to address\nCVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,\nand CVE-2025-49796.\n\n## Impact and severity\n\n### CVE-2025-6021\n\nA flaw was found in libxml2's xmlBuildQName function, where integer\noverflows in buffer size calculations can lead to a stack-based\nbuffer overflow. This issue can result in memory corruption or a\ndenial of service when processing crafted input.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae\n\n### CVE-2025-6170\n\nA flaw was found in the interactive shell of the xmllint command-line\ntool, used for parsing XML files. When a user inputs an overly long\ncommand, the program does not check the input size properly, which\ncan cause it to crash. This issue might allow attackers to run\nharmful code in rare configurations without modern protections.\n\nNVD claims a severity of 2.5 Low\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1\n\n### CVE-2025-49794\n\nA use-after-free vulnerability was found in libxml2. This issue\noccurs when parsing XPath elements under certain circumstances when\nthe XML schematron has the <sch:name path=\"...\"/> schema elements.\nThis flaw allows a malicious actor to craft a malicious XML document\nused as input for libxml, resulting in the program's crash using\nlibxml or other possible undefined behaviors.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n### CVE-2025-49795\n\nA NULL pointer dereference vulnerability was found in libxml2 when\nprocessing XPath XML expressions. This flaw allows an attacker to\ncraft a malicious XML input to libxml2, leading to a denial of service.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278\n\n### CVE-2025-49796\n\nA vulnerability was found in libxml2. Processing certain sch:name\nelements from the input XML file can trigger a memory corruption\nissue. This flaw allows an attacker to craft a malicious XML input\nfile that can lead libxml to crash, resulting in a denial of service\nor other possible undefined behavior due to sensitive data being\ncorrupted in memory.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n## Affected Versions\n\n- Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2\n\n## Patched Versions\n\n- Nokogiri >= 1.18.9\n\n## Mitigation\n\nUpgrade to Nokogiri v1.18.9 or later.\n\nUsers who are unable to upgrade Nokogiri may also choose a more\ncomplicated mitigation: compile and link Nokogiri against patched\nexternal libxml2 libraries which will also address these same issues.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/3526","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/pull/3526"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49794","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49794"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49795","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49795"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49796","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49796"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6021","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6021"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6170","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6170"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/168187?format=json","purl":"pkg:gem/nokogiri@1.18.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gpcm-1wx2-guhq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.9"}],"aliases":["GHSA-353f-x4gh-cqq8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-e37h-xnn4-hbcn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12811?format=json","vulnerability_id":"VCID-f91q-9psx-qkaa","summary":"NULL Pointer Dereference\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2019:1543","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://access.redhat.com/errata/RHSA-2019:1543"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14404","reference_id":"","reference_type":"","scores":[{"value":"0.20012","scoring_system":"epss","scoring_elements":"0.95579","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14404"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595985"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1785","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1785"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/issues/10","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxml2/issues/10"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190719-0002","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20190719-0002"},{"reference_url":"https://usn.ubuntu.com/3739-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3739-1"},{"reference_url":"https://usn.ubuntu.com/3739-2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3739-2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404","reference_id":"CVE-2018-14404","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14404"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml","reference_id":"CVE-2018-14404.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml"},{"reference_url":"https://github.com/advisories/GHSA-6qvp-r6r3-9p7h","reference_id":"GHSA-6qvp-r6r3-9p7h","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6qvp-r6r3-9p7h"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190719-0002/","reference_id":"ntap-20190719-0002","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://security.netapp.com/advisory/ntap-20190719-0002/"},{"reference_url":"https://usn.ubuntu.com/3739-2/","reference_id":"USN-3739-2","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/"}],"url":"https://usn.ubuntu.com/3739-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56340?format=json","purl":"pkg:gem/nokogiri@1.8.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.5"}],"aliases":["CVE-2018-14404","GHSA-6qvp-r6r3-9p7h"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f91q-9psx-qkaa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/22601?format=json","vulnerability_id":"VCID-gpcm-1wx2-guhq","summary":"Nokogiri does not check the return value from xmlC14NExecute\nNokogiri's CRuby extension fails to check the return value from `xmlC14NExecute` in the method `Nokogiri::XML::Document#canonicalize` and `Nokogiri::XML::Node#canonicalize`. When canonicalization fails, an empty string is returned instead of raising an exception. This incorrect return value may allow downstream libraries to accept invalid or incomplete canonicalized XML, which has been demonstrated to enable signature validation bypass in SAML libraries.\n\nJRuby is not affected, as the Java implementation correctly raises `RuntimeError` on canonicalization failure.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/advisories/GHSA-wx95-c6cv-8532","reference_id":"GHSA-wx95-c6cv-8532","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wx95-c6cv-8532"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532","reference_id":"GHSA-wx95-c6cv-8532","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":""},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/72892?format=json","purl":"pkg:gem/nokogiri@1.19.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-gpcm-1wx2-guhq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.19.1"}],"aliases":["GHSA-wx95-c6cv-8532"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gpcm-1wx2-guhq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10757?format=json","vulnerability_id":"VCID-hmj1-53pj-2ugn","summary":"Multiple vulnerabilities in libxml2, libxslt\nThe vendored libxml2 and libxslt libraries have multiple vulnerabilities: CVE-2015-1819 CVE-2015-7941_1 CVE-2015-7941_2 CVE-2015-7942 CVE-2015-7942-2 CVE-2015-8035 CVE-2015-7995","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22"},{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359"},{"reference_url":"https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51336?format=json","purl":"pkg:gem/nokogiri@1.6.6.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.3"},{"url":"http://public2.vulnerablecode.io/api/packages/51280?format=json","purl":"pkg:gem/nokogiri@1.6.7.rc4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4"}],"aliases":["GMS-2015-42"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hmj1-53pj-2ugn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/2556?format=json","vulnerability_id":"VCID-jn4q-gdy9-eqa4","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5029","reference_id":"","reference_type":"","scores":[{"value":"0.01266","scoring_system":"epss","scoring_elements":"0.79769","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5029"},{"reference_url":"https://crbug.com/676623","reference_id":"","reference_type":"","scores":[],"url":"https://crbug.com/676623"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv2","scoring_elements":"AV:L/AC:M/Au:N/C:N/I:P/A:P"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1634","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1634"},{"reference_url":"https://ubuntu.com/security/notices/USN-3271-1","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://ubuntu.com/security/notices/USN-3271-1"},{"reference_url":"http://www.securityfocus.com/bid/96767","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/96767"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546","reference_id":"858546","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546"},{"reference_url":"https://security.archlinux.org/ASA-201703-4","reference_id":"ASA-201703-4","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201703-4"},{"reference_url":"https://security.archlinux.org/ASA-201703-5","reference_id":"ASA-201703-5","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201703-5"},{"reference_url":"https://security.archlinux.org/AVG-195","reference_id":"AVG-195","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-195"},{"reference_url":"https://security.archlinux.org/AVG-196","reference_id":"AVG-196","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-196"},{"reference_url":"https://security.archlinux.org/AVG-197","reference_id":"AVG-197","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-197"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5029","reference_id":"CVE-2017-5029","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5029"},{"reference_url":"https://ubuntu.com/security/CVE-2017-5029","reference_id":"CVE-2017-5029","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://ubuntu.com/security/CVE-2017-5029"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml","reference_id":"CVE-2017-5029.YML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml"},{"reference_url":"https://github.com/advisories/GHSA-pf6m-fxpq-fg8v","reference_id":"GHSA-pf6m-fxpq-fg8v","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-pf6m-fxpq-fg8v"},{"reference_url":"https://security.gentoo.org/glsa/201804-01","reference_id":"GLSA-201804-01","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201804-01"},{"reference_url":"https://usn.ubuntu.com/3236-1/","reference_id":"USN-3236-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3236-1/"},{"reference_url":"https://usn.ubuntu.com/3271-1/","reference_id":"USN-3271-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3271-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51850?format=json","purl":"pkg:gem/nokogiri@1.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1"},{"url":"http://public2.vulnerablecode.io/api/packages/73831?format=json","purl":"pkg:gem/nokogiri@1.7.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.2"}],"aliases":["CVE-2017-5029","GHSA-pf6m-fxpq-fg8v"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jn4q-gdy9-eqa4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12242?format=json","vulnerability_id":"VCID-jvbh-pnxm-9bg7","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nIn the Loofah gem for Ruby, denylisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8048","reference_id":"","reference_type":"","scores":[{"value":"0.00689","scoring_system":"epss","scoring_elements":"0.72098","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8048"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/flavorjones/loofah","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/flavorjones/loofah"},{"reference_url":"https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116"},{"reference_url":"https://github.com/flavorjones/loofah/issues/144","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":""},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/flavorjones/loofah/issues/144"},{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/1746","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3","scoring_elements":""},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/pull/1746"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191122-0003","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20191122-0003"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191122-0003/","reference_id":"","reference_type":"","scores":[],"url":"https://security.netapp.com/advisory/ntap-20191122-0003/"},{"reference_url":"https://www.debian.org/security/2018/dsa-4171","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4171"},{"reference_url":"http://www.openwall.com/lists/oss-security/2018/03/19/5","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2018/03/19/5"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596","reference_id":"893596","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8048","reference_id":"CVE-2018-8048","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8048"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml","reference_id":"CVE-2018-8048.YML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml","reference_id":"CVE-2018-8048.YML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml"},{"reference_url":"https://github.com/advisories/GHSA-x7rv-cr6v-4vm4","reference_id":"GHSA-x7rv-cr6v-4vm4","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x7rv-cr6v-4vm4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54223?format=json","purl":"pkg:gem/nokogiri@1.8.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.3"}],"aliases":["CVE-2018-8048","GHSA-x7rv-cr6v-4vm4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jvbh-pnxm-9bg7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15489?format=json","vulnerability_id":"VCID-jwaq-3j9v-nbde","summary":"Inefficient Regular Expression Complexity\nNokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24836","reference_id":"","reference_type":"","scores":[{"value":"0.01827","scoring_system":"epss","scoring_elements":"0.83216","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24836"},{"reference_url":"http://seclists.org/fulldisclosure/2022/Dec/23","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://seclists.org/fulldisclosure/2022/Dec/23"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd"},{"reference_url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4"},{"reference_url":"https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/"},{"reference_url":"https://security.gentoo.org/glsa/202208-29","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202208-29"},{"reference_url":"https://support.apple.com/kb/HT213532","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/kb/HT213532"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787","reference_id":"1009787","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836","reference_id":"CVE-2022-24836","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml","reference_id":"CVE-2022-24836.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml"},{"reference_url":"https://github.com/advisories/GHSA-crjr-9rc5-ghw8","reference_id":"GHSA-crjr-9rc5-ghw8","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-crjr-9rc5-ghw8"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8","reference_id":"GHSA-crjr-9rc5-ghw8","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60098?format=json","purl":"pkg:gem/nokogiri@1.13.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4"}],"aliases":["CVE-2022-24836","GHSA-crjr-9rc5-ghw8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jwaq-3j9v-nbde"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19362?format=json","vulnerability_id":"VCID-ktaj-j2nh-zug6","summary":"Duplicate\nThis advisory duplicates another.","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/discussions/3146","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/discussions/3146"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/604","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/604"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25062","reference_id":"CVE-2024-25062","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25062"},{"reference_url":"https://github.com/advisories/GHSA-xc9x-jj77-9p9j","reference_id":"GHSA-xc9x-jj77-9p9j","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xc9x-jj77-9p9j"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j","reference_id":"GHSA-xc9x-jj77-9p9j","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml","reference_id":"GHSA-xc9x-jj77-9p9j.yml","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67577?format=json","purl":"pkg:gem/nokogiri@1.15.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.15.6"},{"url":"http://public2.vulnerablecode.io/api/packages/164329?format=json","purl":"pkg:gem/nokogiri@1.16.0.rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.0.rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/67576?format=json","purl":"pkg:gem/nokogiri@1.16.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.2"}],"aliases":["GHSA-xc9x-jj77-9p9j","GMS-2024-127"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ktaj-j2nh-zug6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13760?format=json","vulnerability_id":"VCID-kzy6-b4n3-m7d4","summary":"Improper Input Validation\nIn `numbers.c` in libxslt, which is used by nokogiri, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.","references":[{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13118","reference_id":"","reference_type":"","scores":[{"value":"0.01008","scoring_system":"epss","scoring_elements":"0.77366","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-13118"},{"reference_url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Aug/11","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Aug/11"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Aug/13","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Aug/13"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Aug/14","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Aug/14"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Aug/15","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Aug/15"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/22","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/22"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/23","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/23"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/24","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/24"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/26","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/26"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/31","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/31"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/37","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/37"},{"reference_url":"http://seclists.org/fulldisclosure/2019/Jul/38","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://seclists.org/fulldisclosure/2019/Jul/38"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1943","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1943"},{"reference_url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b"},{"reference_url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ"},{"reference_url":"https://oss-fuzz.com/testcase-detail/5197371471822848","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://oss-fuzz.com/testcase-detail/5197371471822848"},{"reference_url":"https://seclists.org/bugtraq/2019/Aug/21","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Aug/21"},{"reference_url":"https://seclists.org/bugtraq/2019/Aug/22","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Aug/22"},{"reference_url":"https://seclists.org/bugtraq/2019/Aug/23","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Aug/23"},{"reference_url":"https://seclists.org/bugtraq/2019/Aug/25","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Aug/25"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/35","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/35"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/36","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/36"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/37","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/37"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/40","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/40"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/41","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/41"},{"reference_url":"https://seclists.org/bugtraq/2019/Jul/42","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://seclists.org/bugtraq/2019/Jul/42"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190806-0004","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20190806-0004"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200122-0003","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20200122-0003"},{"reference_url":"https://support.apple.com/kb/HT210346","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210346"},{"reference_url":"https://support.apple.com/kb/HT210348","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210348"},{"reference_url":"https://support.apple.com/kb/HT210351","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210351"},{"reference_url":"https://support.apple.com/kb/HT210353","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210353"},{"reference_url":"https://support.apple.com/kb/HT210356","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210356"},{"reference_url":"https://support.apple.com/kb/HT210357","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210357"},{"reference_url":"https://support.apple.com/kb/HT210358","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://support.apple.com/kb/HT210358"},{"reference_url":"https://usn.ubuntu.com/4164-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4164-1"},{"reference_url":"https://www.oracle.com/security-alerts/cpujan2020.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/11/17/2","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"http://www.openwall.com/lists/oss-security/2019/11/17/2"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320","reference_id":"931320","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118","reference_id":"CVE-2019-13118","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13118"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/","reference_id":"IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190806-0004/","reference_id":"ntap-20190806-0004","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://security.netapp.com/advisory/ntap-20190806-0004/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200122-0003/","reference_id":"ntap-20200122-0003","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://security.netapp.com/advisory/ntap-20200122-0003/"},{"reference_url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","reference_id":"r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","reference_id":"rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://usn.ubuntu.com/4164-1/","reference_id":"USN-4164-1","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/"}],"url":"https://usn.ubuntu.com/4164-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57262?format=json","purl":"pkg:gem/nokogiri@1.10.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5"}],"aliases":["CVE-2019-13118","GHSA-cf46-6xxh-pc75"],"risk_score":2.6,"exploitability":"0.5","weighted_severity":"5.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kzy6-b4n3-m7d4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/345935?format=json","vulnerability_id":"VCID-m542-6h3p-gudj","summary":"Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n   - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.","references":[{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/165996?format=json","purl":"pkg:gem/nokogiri@1.18.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.3"}],"aliases":["GHSA-vvfq-8hwr-qm4m"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m542-6h3p-gudj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10899?format=json","vulnerability_id":"VCID-mhpn-9y7w-ykcd","summary":"Uncontrolled Resource Consumption\ndict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"<!DOCTYPE html\" substring in a crafted HTML document.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8806","reference_id":"","reference_type":"","scores":[{"value":"0.08565","scoring_system":"epss","scoring_elements":"0.92533","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8806"},{"reference_url":"https://bugzilla.gnome.org/show_bug.cgi?id=749115","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.gnome.org/show_bug.cgi?id=749115"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1473","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1473"},{"reference_url":"https://mail.gnome.org/archives/xml/2016-May/msg00023.html","reference_id":"","reference_type":"","scores":[],"url":"https://mail.gnome.org/archives/xml/2016-May/msg00023.html"},{"reference_url":"https://security.gentoo.org/glsa/201701-37","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201701-37"},{"reference_url":"https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071"},{"reference_url":"https://www.debian.org/security/2016/dsa-3593","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2016/dsa-3593"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/02/03/5","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/02/03/5"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"},{"reference_url":"http://www.ubuntu.com/usn/usn-2994-1/","reference_id":"","reference_type":"","scores":[],"url":"http://www.ubuntu.com/usn/usn-2994-1/"},{"reference_url":"http://www.ubuntu.com/usn/USN-2994-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2994-1"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613","reference_id":"813613","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8806","reference_id":"CVE-2015-8806","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8806"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml","reference_id":"CVE-2015-8806.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml"},{"reference_url":"https://github.com/advisories/GHSA-7hp2-xwpj-95jq","reference_id":"GHSA-7hp2-xwpj-95jq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7hp2-xwpj-95jq"},{"reference_url":"https://usn.ubuntu.com/2994-1/","reference_id":"USN-2994-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2994-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51582?format=json","purl":"pkg:gem/nokogiri@1.6.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8"}],"aliases":["CVE-2015-8806","GHSA-7hp2-xwpj-95jq"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mhpn-9y7w-ykcd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11943?format=json","vulnerability_id":"VCID-p1yd-qud5-ckbu","summary":"Loop with Unreachable Exit Condition ('Infinite Loop')\nparser.c in libxml2 does not prevent infinite recursion in parameter entities.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-16932","reference_id":"","reference_type":"","scores":[{"value":"0.21755","scoring_system":"epss","scoring_elements":"0.95841","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-16932"},{"reference_url":"https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html"},{"reference_url":"https://bugzilla.gnome.org/show_bug.cgi?id=759579","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://bugzilla.gnome.org/show_bug.cgi?id=759579"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1714","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1714"},{"reference_url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html"},{"reference_url":"https://usn.ubuntu.com/3739-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3739-1"},{"reference_url":"https://usn.ubuntu.com/3739-1/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://usn.ubuntu.com/3739-1/"},{"reference_url":"https://usn.ubuntu.com/usn/usn-3504-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/usn/usn-3504-1/"},{"reference_url":"http://xmlsoft.org/news.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"http://xmlsoft.org/news.html"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613","reference_id":"882613","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","reference_id":"899a5d9f0ed13b8e32449a08a361e0de127dd961","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","reference_id":"CVE-2017-16932","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932"},{"reference_url":"https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html","reference_id":"CVE-2017-16932.HTML","reference_type":"","scores":[],"url":"https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml","reference_id":"CVE-2017-16932.YML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml"},{"reference_url":"https://github.com/advisories/GHSA-x2fm-93ww-ggvx","reference_id":"GHSA-x2fm-93ww-ggvx","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x2fm-93ww-ggvx"},{"reference_url":"https://usn.ubuntu.com/3504-1/","reference_id":"USN-3504-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3504-1/"},{"reference_url":"https://usn.ubuntu.com/3504-2/","reference_id":"USN-3504-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3504-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/53076?format=json","purl":"pkg:gem/nokogiri@1.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1"}],"aliases":["CVE-2017-16932","GHSA-x2fm-93ww-ggvx"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p1yd-qud5-ckbu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/147227?format=json","vulnerability_id":"VCID-pffr-3a27-4qgx","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5477","reference_id":"","reference_type":"","scores":[{"value":"0.07465","scoring_system":"epss","scoring_elements":"0.91889","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5477"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1915","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1915"},{"reference_url":"https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc"},{"reference_url":"https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3","scoring_elements":""},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926"},{"reference_url":"https://hackerone.com/reports/650835","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://hackerone.com/reports/650835"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html"},{"reference_url":"https://security.gentoo.org/glsa/202006-05","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/202006-05"},{"reference_url":"https://usn.ubuntu.com/4175-1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4175-1"},{"reference_url":"https://usn.ubuntu.com/4175-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4175-1/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802","reference_id":"934802","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905","reference_id":"940905","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5477","reference_id":"CVE-2019-5477","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5477"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml","reference_id":"CVE-2019-5477.YML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml","reference_id":"CVE-2019-5477.YML","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml"},{"reference_url":"https://github.com/advisories/GHSA-cr5j-953j-xw5p","reference_id":"GHSA-cr5j-953j-xw5p","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cr5j-953j-xw5p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56778?format=json","purl":"pkg:gem/nokogiri@1.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4"}],"aliases":["CVE-2019-5477","GHSA-cr5j-953j-xw5p"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pffr-3a27-4qgx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/78532?format=json","vulnerability_id":"VCID-pzwn-gux6-y3hj","summary":"","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-6685","reference_id":"","reference_type":"","scores":[{"value":"0.00323","scoring_system":"epss","scoring_elements":"0.5559","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-6685"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178970","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178970"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/693","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/693"},{"reference_url":"https://nokogiri.org/CHANGELOG.html#154-2012-06-12","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nokogiri.org/CHANGELOG.html#154-2012-06-12"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6685","reference_id":"CVE-2012-6685","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6685"},{"reference_url":"https://github.com/advisories/GHSA-6wj9-77wq-jq7p","reference_id":"GHSA-6wj9-77wq-jq7p","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6wj9-77wq-jq7p"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/76696?format=json","purl":"pkg:gem/nokogiri@1.5.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-1ksa-wbqf-j7fu"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-ajrr-ueqy-2bam"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.4"}],"aliases":["CVE-2012-6685","GHSA-6wj9-77wq-jq7p","OSV-90946"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pzwn-gux6-y3hj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1720?format=json","vulnerability_id":"VCID-qysn-w1za-83ea","summary":"multiple issues","references":[{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html"},{"reference_url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:0514","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://access.redhat.com/errata/RHSA-2020:0514"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18197","reference_id":"","reference_type":"","scores":[{"value":"0.04534","scoring_system":"epss","scoring_elements":"0.89343","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-18197"},{"reference_url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746"},{"reference_url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768"},{"reference_url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1943","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1943"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191031-0004","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20191031-0004"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200416-0004","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20200416-0004"},{"reference_url":"https://usn.ubuntu.com/4164-1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4164-1"},{"reference_url":"https://www.oracle.com/security-alerts/cpuapr2020.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/11/17/2","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"http://www.openwall.com/lists/oss-security/2019/11/17/2"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646","reference_id":"942646","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646"},{"reference_url":"https://security.archlinux.org/ASA-202002-3","reference_id":"ASA-202002-3","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-202002-3"},{"reference_url":"https://security.archlinux.org/AVG-1092","reference_id":"AVG-1092","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1092"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197","reference_id":"CVE-2019-18197","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18197"},{"reference_url":"https://security.netapp.com/advisory/ntap-20191031-0004/","reference_id":"ntap-20191031-0004","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://security.netapp.com/advisory/ntap-20191031-0004/"},{"reference_url":"https://security.netapp.com/advisory/ntap-20200416-0004/","reference_id":"ntap-20200416-0004","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://security.netapp.com/advisory/ntap-20200416-0004/"},{"reference_url":"https://usn.ubuntu.com/4164-1/","reference_id":"USN-4164-1","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/"}],"url":"https://usn.ubuntu.com/4164-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57262?format=json","purl":"pkg:gem/nokogiri@1.10.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5"}],"aliases":["CVE-2019-18197","GHSA-242x-7cm6-4w8j"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qysn-w1za-83ea"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/6161?format=json","vulnerability_id":"VCID-sgvg-768f-gybf","summary":"denial of service","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-18258","reference_id":"","reference_type":"","scores":[{"value":"0.00898","scoring_system":"epss","scoring_elements":"0.75983","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-18258"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb"},{"reference_url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10284","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10284"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190719-0001","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20190719-0001"},{"reference_url":"https://security.netapp.com/advisory/ntap-20190719-0001/","reference_id":"","reference_type":"","scores":[],"url":"https://security.netapp.com/advisory/ntap-20190719-0001/"},{"reference_url":"https://usn.ubuntu.com/3739-1","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/3739-1"},{"reference_url":"https://usn.ubuntu.com/3739-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3739-1/"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245","reference_id":"895245","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245"},{"reference_url":"https://security.archlinux.org/AVG-671","reference_id":"AVG-671","reference_type":"","scores":[{"value":"Medium","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-671"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258","reference_id":"CVE-2017-18258","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18258"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml","reference_id":"CVE-2017-18258.YML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml"},{"reference_url":"https://github.com/advisories/GHSA-882p-jqgm-f45g","reference_id":"GHSA-882p-jqgm-f45g","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-882p-jqgm-f45g"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54339?format=json","purl":"pkg:gem/nokogiri@1.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2"}],"aliases":["CVE-2017-18258","GHSA-882p-jqgm-f45g"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sgvg-768f-gybf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10708?format=json","vulnerability_id":"VCID-snqn-nz53-f3b7","summary":"Vulnerabilities in libxml2 and libxslt\nSeveral vulnerabilities were discovered in the libxml2 and libxslt libraries that this package gem depends on.","references":[{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html"},{"reference_url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html"},{"reference_url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-1419.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-1419.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-2550.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1819","reference_id":"","reference_type":"","scores":[{"value":"0.02045","scoring_system":"epss","scoring_elements":"0.84139","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1819"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710"},{"reference_url":"https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9"},{"reference_url":"https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1374","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/1374"},{"reference_url":"https://github.com/sparklemotion/nokogiri/pull/1376","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/pull/1376"},{"reference_url":"https://security.gentoo.org/glsa/201507-08","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201507-08"},{"reference_url":"https://security.gentoo.org/glsa/201701-37","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201701-37"},{"reference_url":"https://support.apple.com/HT206166","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206166"},{"reference_url":"https://support.apple.com/HT206167","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206167"},{"reference_url":"https://support.apple.com/HT206168","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206168"},{"reference_url":"https://support.apple.com/HT206169","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://support.apple.com/HT206169"},{"reference_url":"http://www.debian.org/security/2015/dsa-3430","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2015/dsa-3430"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"},{"reference_url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"},{"reference_url":"http://www.ubuntu.com/usn/USN-2812-1","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.ubuntu.com/usn/USN-2812-1"},{"reference_url":"http://xmlsoft.org/news.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://xmlsoft.org/news.html"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782","reference_id":"782782","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1819","reference_id":"CVE-2015-1819","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1819"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml","reference_id":"CVE-2015-1819.YML","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml"},{"reference_url":"https://github.com/advisories/GHSA-q7wx-62r7-j2x7","reference_id":"GHSA-q7wx-62r7-j2x7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q7wx-62r7-j2x7"},{"reference_url":"https://usn.ubuntu.com/2812-1/","reference_id":"USN-2812-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2812-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51279?format=json","purl":"pkg:gem/nokogiri@1.6.6.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4"},{"url":"http://public2.vulnerablecode.io/api/packages/51280?format=json","purl":"pkg:gem/nokogiri@1.6.7.rc4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-b2g7-1rh9-jkgb"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4"}],"aliases":["CVE-2015-1819","GHSA-q7wx-62r7-j2x7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-snqn-nz53-f3b7"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11610?format=json","vulnerability_id":"VCID-tswn-2k3y-wkhk","summary":"Vulnerabilities in libxml2\nThe version of libxml2 packaged with Nokogiri contains several vulnerabilities. Nokogiri has mitigated these issues by upgrading to libxml It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-0663) It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. (CVE-2017-7375) It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-7376) Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-9047) Marcel Böhme and Van-Thuan Pham discovered a buffer overread in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service. (CVE-2017-9048) Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads in libxml2 when handling parameter-entity references. An attacker could use these to specially construct XML data that could cause a denial of service. (CVE-2017-9049, CVE-2017-9050)","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/1673","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/sparklemotion/nokogiri/issues/1673"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/53076?format=json","purl":"pkg:gem/nokogiri@1.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1"}],"aliases":["USN-3424-1"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tswn-2k3y-wkhk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10946?format=json","vulnerability_id":"VCID-vy1s-s9ff-6yhy","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nnokogiri mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.","references":[{"reference_url":"http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html","reference_id":"","reference_type":"","scores":[],"url":"http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1683","reference_id":"","reference_type":"","scores":[{"value":"0.00989","scoring_system":"epss","scoring_elements":"0.77167","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-1683"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340016","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1340016"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1683","reference_id":"CVE-2016-1683","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1683"},{"reference_url":"https://security.gentoo.org/glsa/201607-07","reference_id":"GLSA-201607-07","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201607-07"},{"reference_url":"https://usn.ubuntu.com/2992-1/","reference_id":"USN-2992-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/2992-1/"},{"reference_url":"https://usn.ubuntu.com/3271-1/","reference_id":"USN-3271-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/3271-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51688?format=json","purl":"pkg:gem/nokogiri@1.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1h5h-pvc7-9yhh"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-1ksa-wbqf-j7fu"},{"vulnerability":"VCID-2ub7-t6nu-syfs"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-8274-u9e9-uufm"},{"vulnerability":"VCID-94b6-kg9t-fbee"},{"vulnerability":"VCID-94mh-kks8-4yf4"},{"vulnerability":"VCID-9mh9-rax2-1bbb"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-9xty-6acy-mub7"},{"vulnerability":"VCID-ajrr-ueqy-2bam"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-f91q-9psx-qkaa"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-hmj1-53pj-2ugn"},{"vulnerability":"VCID-jn4q-gdy9-eqa4"},{"vulnerability":"VCID-jvbh-pnxm-9bg7"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-kzy6-b4n3-m7d4"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-mhpn-9y7w-ykcd"},{"vulnerability":"VCID-p1yd-qud5-ckbu"},{"vulnerability":"VCID-pffr-3a27-4qgx"},{"vulnerability":"VCID-pzwn-gux6-y3hj"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-sgvg-768f-gybf"},{"vulnerability":"VCID-snqn-nz53-f3b7"},{"vulnerability":"VCID-tswn-2k3y-wkhk"},{"vulnerability":"VCID-w6ws-2kbb-bfgs"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.2.0"}],"aliases":["CVE-2016-1683"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vy1s-s9ff-6yhy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/1869?format=json","vulnerability_id":"VCID-w6ws-2kbb-bfgs","summary":"multiple issues","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5815","reference_id":"","reference_type":"","scores":[{"value":"0.00111","scoring_system":"epss","scoring_elements":"0.29283","published_at":"2026-05-30T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-5815"},{"reference_url":"https://bugs.chromium.org/p/chromium/issues/detail?id=930663","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.chromium.org/p/chromium/issues/detail?id=930663"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml"},{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/sparklemotion/nokogiri/issues/2630","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":""},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/issues/2630"},{"reference_url":"https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html"},{"reference_url":"https://security.archlinux.org/ASA-201904-12","reference_id":"ASA-201904-12","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201904-12"},{"reference_url":"https://security.archlinux.org/AVG-952","reference_id":"AVG-952","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-952"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5815","reference_id":"CVE-2019-5815","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5815"},{"reference_url":"https://security.gentoo.org/glsa/201908-18","reference_id":"GLSA-201908-18","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201908-18"},{"reference_url":"https://usn.ubuntu.com/5575-1/","reference_id":"USN-5575-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5575-1/"},{"reference_url":"https://usn.ubuntu.com/5575-2/","reference_id":"USN-5575-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5575-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/56778?format=json","purl":"pkg:gem/nokogiri@1.10.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-9psz-qfqt-e3fs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-qysn-w1za-83ea"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4"},{"url":"http://public2.vulnerablecode.io/api/packages/57262?format=json","purl":"pkg:gem/nokogiri@1.10.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-12ee-na2t-6kg5"},{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-jwaq-3j9v-nbde"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"},{"vulnerability":"VCID-zka7-1e8v-d3d7"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5"}],"aliases":["CVE-2019-5815","GHSA-vmfx-gcfq-wvm2"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w6ws-2kbb-bfgs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/340591?format=json","vulnerability_id":"VCID-zka7-1e8v-d3d7","summary":"Update bundled libxml2 to v2.10.3 to resolve multiple CVEs","references":[{"reference_url":"https://github.com/sparklemotion/nokogiri","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri"},{"reference_url":"https://github.com/advisories/GHSA-2qc6-mcvw-92cw","reference_id":"GHSA-2qc6-mcvw-92cw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2qc6-mcvw-92cw"},{"reference_url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw","reference_id":"GHSA-2qc6-mcvw-92cw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/79536?format=json","purl":"pkg:gem/nokogiri@1.13.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1ks1-3a4g-eqe7"},{"vulnerability":"VCID-4yvf-h1z3-nfd7"},{"vulnerability":"VCID-6b72-3exf-qfhs"},{"vulnerability":"VCID-arq2-c738-tugt"},{"vulnerability":"VCID-e37h-xnn4-hbcn"},{"vulnerability":"VCID-gpcm-1wx2-guhq"},{"vulnerability":"VCID-ktaj-j2nh-zug6"},{"vulnerability":"VCID-m542-6h3p-gudj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9"}],"aliases":["GHSA-2qc6-mcvw-92cw"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zka7-1e8v-d3d7"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.0.1"}