CVE-2026-122006Critical· 9.8▾ AbyssalPoC availableThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attach…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
0.7% → 0.7%
1 GitHub repo (last check)
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
active_storage < 8.0.5.2active_storage >= 8.1 < 8.1.4.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116244High· 8.2pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-118691Low· 3.7xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
CVE-2026-114397High· 7.4Trudesk through 1.2.11 Missing Authentication on Debug Routes
CVE-2026-111764High· 7.5A2A Java SDK has a fail-open default task authorization
CVE-2026-77934High· 8.8Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
CVE-2026-77936Critical· 9.8Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access