The vulnerability of the Active Storage component of the Ruby on Rails software framework allows attackers to execute arbitrary code.

The vulnerability of the Active Storage component in the Ruby on Rails programming framework is related to insufficient checking of the intentions by the recipient of the broadcast message. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash-fips, kube-logging-operator,...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash-fips, kube-logging-operator,...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, ruby3.4-rails, ruby3.3-rails, logstash, pact-broker-docker, gitlab-rails-ce, ruby3.2-rails, logstash-fips, kube-logging-operator, ruby4.0-rails...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, ruby3.4-rails, ruby3.3-rails, logstash, pact-broker-docker, gitlab-rails-ce, ruby3.2-rails, logstash-fips, kube-logging-operator, ruby4.0-rails...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: pact-broker-docker-fips, ruby3.4-rails, ruby3.3-rails, logstash, pact-broker-docker, gitlab-rails-ce, ruby3.2-rails, logstash-fips, kube-logging-operator, ruby4.0-rails...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.3-rails, logstash, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-rails, ruby4.0-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash-fips, kube-logging-operator,...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-rails, ruby3.4-rails, logstash...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.2-rails, ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.2-rails, ruby3.4-rails, ruby4.0-fluentd-kubernetes-daemonset...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-rails, ruby3.4-rails, logstash...

Security Bulletin: IBM Security Network Intrusion Prevention System can be affected by vulnerabilities in Ruby on Rails (CVE-2012-2660, CVE-2012-2694, CVE-2013-0156, CVE-2012-6496, CVE-2012-3424, and CVE-2012-2695)

Question Is the Network IPS system affected by Ruby on Rails vulnerabilities? "Product":"code":"SS9SBT","label":"Proventia Network Intrusion Prevention System","Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Component":"General...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Tuzitio Camaleon_Cms

HTB Facts — Full Writeup Difficulty: Medium OS: Lin...

Linux Distros Unpatched Vulnerability : CVE-2026-44837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint...

CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

DEBIAN-CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

CVE-2026-44837

ViewComponent CVE-2026-44837 affects Rails ViewComponent from 3.0.0 to 4.9.0. Root cause: system test entrypoint uses File.realpath and starts_with to check the path, which is not a safe containment check and allows potential sibling-directory escapes. Impact: could permit access to files outside...

CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

EUVD-2026-31971

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

The vulnerability of the Active Storage component in the Ruby on Rails software framework allows attackers to trigger a service failure.

The vulnerability of the Active Storage component in the Ruby on Rails software framework is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...