Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
Affected vendors and products
More on Unauthenticated
Other advisories
- CriticalCVE-2026-124426Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491)
- CriticalCVE-2026-121640WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640)
- CriticalCVE-2026-73578Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass
- Not ratedosv:CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- Not ratedosv:CVE-2026-63482Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
- Lowghsa:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:GHSA-m3qr-fvp4-78xjArc has unauthenticated application log disclosure via `/api/v1/logs`
- Not ratedosv:CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
Other news entries
- Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityNewsCisco PSIRT
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick UploadsNewsThe Hacker News
- Cisco Secure Email Gateway SQL Injection VulnerabilityNewsCisco PSIRT
- Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on ServersNewsThe Hacker News
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessNewsThe Hacker News
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversNewsBleepingComputer
- Linux kernel exploit enables remote root attacks on MPTCP serversNewsBleepingComputer
Source: https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html
ID