Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
49 results
Sep 30, 2026Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user fCVE-2026-55107 · Other software · elct9620 · reported by GitHubCritical 10
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1.
- Product
- kobako
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0.CVE-2026-79590 · Other software · reported by MITREMedium 6.5
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode.CVE-2026-86547 · Other software · mrubyc · reported by VulnCheckMedium 6.9
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.
- Product
- mrubyc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A flaw has been found in mruby 3.1.0.CVE-2022-4996 · Other software · reported by VulDBMedium 5.5
A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to apply a patch to resolve this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.CVE-2026-38976 · Other software · reported by MITREHigh 7.5
mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().CVE-2026-38973 · Other software · reported by MITREMedium 4.4
mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026A flaw has been found in mruby up to 3.4.0.CVE-2026-1979 · Other software · Mruby · reported by VulDBLow 1.9
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025A security vulnerability has been detected in mrubyc up to 3.4.CVE-2025-13397 · Other software · S-itoc · reported by VulDBMedium 4.8
A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is 009111904807b8567262036bf45297c3da8f1c87. It is advisable to implement a patch to correct this issue.
- Product
- Mruby/c
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025A vulnerability has been found in mruby up to 3.4.0.CVE-2025-13120 · Other software · Mruby · reported by VulDBLow 1.9
A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025A weakness has been identified in mruby 3.4.0.CVE-2025-12875 · Other software · Mruby · reported by VulDBLow 1.9
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2.CVE-2025-7207 · Other software · Mruby · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc.CVE-2021-46023 · Other software · Mruby · reported by MITREHigh 7.5
An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2022Use After Free in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1934 · Other software · mruby · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1427 · Other software · mruby · reported by security@huntr.devHigh 7.8
Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1286 · Other software · mruby · reported by security@huntr.devCritical 9.8
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1276 · Other software · mruby · reported by security@huntr.devCritical 9.8
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1212 · Other software · mruby · reported by security@huntr.devCritical 9.8
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2022NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1201 · Other software · mruby · reported by security@huntr.devMedium 6.5
NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1106 · Other software · mruby · reported by security@huntr.devCritical 9.1
use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1071 · Other software · mruby · reported by security@huntr.devHigh 8.2
User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.CVE-2022-0890 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.CVE-2022-0717 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0632 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0630 · Other software · mruby · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0631 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0623 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.CVE-2022-0614 · Other software · mruby · reported by security@huntr.devMedium 5.5
Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0570 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0525 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0481 · Other software · mruby · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0326 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022mruby is vulnerable to NULL Pointer DereferenceCVE-2022-0240 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.CVE-2021-46020 · Other software · Mruby · reported by MITREHigh 7.5
An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2022mruby is vulnerable to Heap-based Buffer OverflowCVE-2022-0080 · Other software · mruby · reported by security@huntr.devCritical 9.8
mruby is vulnerable to Heap-based Buffer Overflow
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2021mruby is vulnerable to NULL Pointer DereferenceCVE-2021-4188 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021mruby is vulnerable to NULL Pointer DereferenceCVE-2021-4110 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).CVE-2020-36401 · Other software · Mruby · reported by MITREHigh 7.8
mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Jul 21, 2020mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling.CVE-2020-15866 · Other software · Mruby · reported by MITRECritical 9.8
mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy function.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 10, 2020In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.CVE-2020-6840 · Other software · Mruby · reported by MITRECritical 9.8
In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2020In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.CVE-2020-6839 · Other software · Mruby · reported by MITRECritical 9.8
In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2020In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.CVE-2020-6838 · Other software · Mruby · reported by MITRECritical 9.8
In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2018The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access becausCVE-2018-14337 · Other software · Mruby · reported by MITREHigh 7.5
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 12, 2018An issue was discovered in mruby 1.4.1.CVE-2018-12249 · Other software · Mruby · reported by MITREHigh 7.5
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered in mruby 1.4.1.CVE-2018-12248 · Other software · Mruby · reported by MITREHigh 7.5
An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2018An issue was discovered in mruby 1.4.1.CVE-2018-12247 · Other software · Mruby · reported by MITREHigh 7.5
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2018The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_haCVE-2018-11743 · Other software · Mruby · reported by MITRECritical 9.8
The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2018In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy().CVE-2018-10199 · Other software · Mruby · reported by MITRECritical 9.8
In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2018In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope neCVE-2018-10191 · Other software · Mruby · reported by MITRECritical 9.8
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2017The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) oCVE-2017-9527 · Other software · Mruby · reported by MITREHigh 7.8
The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.