Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

CVE-2026-63414

In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify

来源摘录 · GitHub Advisory

Crass: Non-ASCII characters cause superlinear CPU consumption

CVE-2026-61848

### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of m

来源摘录 · GitHub Advisory

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

CVE-2026-61847

### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comm

来源摘录 · GitHub Advisory

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

CVE-2026-61846

### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value

来源摘录 · GitHub Advisory

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

CVE-2026-116695

## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a

来源摘录 · GitHub Advisory

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash...

CVE-2026-116695

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectl

来源摘录 · NVD / GitHub Advisory

Mechanize sends credential headers to another origin after a meta refresh

CVE-2026-107399

## Summary `mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_hea

历史摘要 · 未重新核验 · GitHub Advisory

Mechanize sends credential headers to another host after an HTTP redirect

CVE-2026-107715

## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credent

历史摘要 · 未重新核验 · GitHub Advisory

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an

历史摘要 · 未重新核验 · GitHub Advisory

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

CVE-2026-77602

### Summary COSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-i

历史摘要 · 未重新核验 · GitHub Advisory

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

CVE-2026-77601

## Summary An authenticated user can execute arbitrary operating system commands on the `openc3-cosmos-cmd-tlm-api` serv

历史摘要 · 未重新核验 · GitHub Advisory

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

CVE-2026-94462

## Summary The Store API v3 endpoint `PATCH /api/v3/store/carts/:id/associate` binds a guest cart to the authenticated

历史摘要 · 未重新核验 · GitHub Advisory

Mail: Email address spoofing via malformed RFC 2047 encoded-words

CVE-2026-63435

## Summary Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode decoded only the first RFC 2047 encoded-wo

历史摘要 · 未重新核验 · GitHub Advisory

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

CVE-2026-55107

### Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully

历史摘要 · 未重新核验 · GitHub Advisory

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

CVE-2026-71847

### Summary Ruby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.s

历史摘要 · 未重新核验 · GitHub Advisory

guard-livereload has a directory traversal vulnerability

CVE-2016-1000305

The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation i

历史摘要 · 未重新核验 · GitHub Advisory

Savon::Model evaluates WSDL operation names as Ruby source

CVE-2026-53510

### Impact `Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to

历史摘要 · 未重新核验 · GitHub Advisory

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

### Summary Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the res

历史摘要 · 未重新核验 · GitHub Advisory

Pagy I18n locale option is not validated before being used in a file path

CVE-2026-54659

### Summary `Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching

历史摘要 · 未重新核验 · GitHub Advisory

Ruby json: JSON generator heap buffer overflow when streaming to an IO

CVE-2026-54696

### Summary `JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the internal JSON generator buffer

历史摘要 · 未重新核验 · GitHub Advisory