Vulnerability disclosures, patches, and security advisories for Ruby on Rails and its ecosystem — including Active Storage, Action Pack, and other framework components. Rails powers a broad share of production web applications, so critical flaws in shared components can expose application secrets and server files across thousands of deployments simultaneously. Combined article + CVE feed for the Ruby on Rails beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2026-66066/https://0daynews.com/cve/cve-2026-66066/Unauthenticated file read in Rails Active Storage via libvips image processing. CVSSv4 9.5, critical. Patch released July 29, 2026.Thu, 03 Sep 2026 00:00:00 GMTRuby on Railscriticalcvehttps://0daynews.com/articles/2026-07-29-rails-active-storage-critical-file-read/https://0daynews.com/articles/2026-07-29-rails-active-storage-critical-file-read/Ruby on Rails patches a critical Active Storage flaw letting unauthenticated attackers read server files—exposing app secrets and database credentials through crafted image uploads.Wed, 29 Jul 2026 18:30:00 GMTRuby on Railsarticle