CVE-2024-58378Critical· 9.8▾ MidnightNokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When u…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062) in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing a crafted XML document can lead to an xmlValidatePopElement use-after-free. Nokogiri 1.15.6 and 1.16.2 resolve this by upgrading the packaged libxml2 to 2.11.7 and 2.12.5 respectively. JRuby and installations using system libxml2 are not affected.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113344High· 8.8chromium-browser: chromium-browser: Use after free in Performance (CVE-2026-113344)
CVE-2026-54171Medium· 6.5excon: Excon: Information disclosure via unstripped sensitive headers during redirects (CVE-2026-54171)
CVE-2026-98870Medium· 6.5kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
CVE-2026-55889Medium· 5.3xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2022-3256High· 7.8Use After Free in GitHub repository vim/vim prior to 9.0.0530.