Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-122006

activestorage: activestorage: arbitrary file read and write via ImageMagick attachment analysis

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Rubyonrails
Products
Active Storage
CVE-2022-21831

rubygem-activestorage: Code injection vulnerability in ActiveStorage

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Rubyonrails
Products
Debian Linux Active Storage