Exploit for CVE-2026-66066

rails-activestorage-vips-audit An Agent Skillhttps://agent...

PT-2026-65864

Name of the Vulnerable Software and Affected Versions Ruby on Rails affected versions not specified Description An issue exists in applications using Active Storage with Vips that allows unauthenticated attackers to read server files by uploading crafted images. This could lead to the exposure of...

Possible arbitrary file read and remote code execution in Active Storage variant processing

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which...

CVE-2026-13311 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, code-server, gemini-cli, arangodb, gitlab-rails-ce-fips...

GHSA-395F-4HP3-45GV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, code-server, gemini-cli, arangodb, gitlab-rails-ce-fips...

CVE-2026-61666 vulnerabilities

Vulnerabilities for packages: pghero-fips, gitlab-rails-ce, pghero, ruby4.0-rails...

GHSA-2X63-GW47-W4MM vulnerabilities

Vulnerabilities for packages: pghero-fips, gitlab-rails-ce, pghero, ruby4.0-rails...

GHSA-8WHX-365G-H9VV vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-CJ75-F6XR-R4G7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-9WJQ-CP2P-HRGF vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-5QHF-9PHG-95M2 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...

GHSA-CJ75-F6XR-R4G7 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, pghero, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

GHSA-9WJQ-CP2P-HRGF vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, pghero, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

GHSA-8WHX-365G-H9VV vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, pghero, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

GHSA-5QHF-9PHG-95M2 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby4.0-rails, pghero, ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...

GHSA-CJ75-F6XR-R4G7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, homepage, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, homepage, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...