Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

Exploit for CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authenticatio...

CVE-2026-55518

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

CVE-2026-55518

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

EUVD-2026-45333

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

CVE-2026-54497: Concurrent Execution using Shared Resource with Improper Synchronization

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to renderin; if the same component, collection, or spacer component instance is reused...

Timing Attack

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...

The vulnerability of the Active Storage component of the Ruby on Rails software framework allows attackers to execute arbitrary code.

The vulnerability of the Active Storage component in the Ruby on Rails programming framework is related to insufficient checking of the intentions by the recipient of the broadcast message. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, logstash, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, gitlab-rails-ce, ruby3.3-rails, pact-broker-docker-fips, logstash-fips...

GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, logstash, kube-logging-operator, cinc-auditor, ruby3.4-rails, ruby3.3-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, kube-fluentd-operator,...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, logstash, kube-logging-operator, cinc-auditor, ruby3.4-rails, ruby3.3-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, kube-fluentd-operator,...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, logstash, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, gitlab-rails-ce, ruby3.3-rails, pact-broker-docker-fips, logstash-fips...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, logstash, kube-logging-operator, ruby3.4-rails, ruby4.0-rails, gitlab-rails-ce, ruby3.3-rails, pact-broker-docker-fips, logstash-fips...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, logstash, kube-logging-operator, cinc-auditor, ruby3.4-rails, ruby3.3-rails, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, kube-fluentd-operator,...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby3.2-rails, logstash...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, cinc-auditor, ruby3.4-fluentd-kubernetes-daemonset, logstash, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-rails, kube-logging-operator, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, kube-logging-operator, ruby3.2-rails, logstash...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, cinc-auditor, ruby3.4-fluentd-kubernetes-daemonset, logstash, ruby4.0-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-rails, kube-logging-operator, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator...

Security Bulletin: IBM Security Network Intrusion Prevention System can be affected by vulnerabilities in Ruby on Rails (CVE-2012-2660, CVE-2012-2694, CVE-2013-0156, CVE-2012-6496, CVE-2012-3424, and CVE-2012-2695)

Question Is the Network IPS system affected by Ruby on Rails vulnerabilities? "Product":"code":"SS9SBT","label":"Proventia Network Intrusion Prevention System","Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Component":"General...