CVE-2026-66066

Overview

rails
rails

30 Jul 2026

Published

01 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.5)

EPSS

1.70%

MITRE

KEV

Description

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

Statistics

2 Posts
1 Interaction

Last activity: Last hour

Fediverse

Günter Born @gborn

Ruby on Rails mit Sicherheitslücke

https://borncity.com/blog/2026/08/01/ruby-on-rails-sicherheitsluecke-cve-2026-66066-ermoeglicht-schluesselklau-ueber-bilder/

1
0
0
Last hour

CyberNetsecIO @netsecio

📰 Ruby on Rails Patches Critical RCE Flaw (CVE-2026-66066)

Ruby on Rails patches critical RCE vulnerability CVE-2026-66066 (CVSS 9.5). The flaw in Active Storage allows arbitrary file read via crafted image uploads, leading to potential RCE. Update immediately. #RubyOnRails #CVE #CyberSecurity

🔗 https://cyber.netsecops.io/articles/ruby-on-rails-patches-critical-rce-flaw-cve-2026-66066/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

0
0
0
4h ago

CVE-2026-67292

Overview

FreeRDP
FreeRDP

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.3)

EPSS

0.26%

MITRE

KEV

Description

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

Statistics

1 Post
2 Interactions

Last activity: 9 hours ago

Fediverse

OffSequence @offseq

FreeRDP <3.29.0 has a CRITICAL buffer over-disclosure (CVE-2026-67292). Malicious WebSocket peers can leak memory or crash clients via crafted Ping frames. No patch confirmed — avoid unknown gateways. Details: https://radar.offseq.com/threat/freerdp-before-3290-contains-a-buffer-over-disclosure-vulnerability-in-the-gateway-websocket-transport-67044e0124c23808 #OffSeq #FreeRDP #CVE202667292 #AppSec

1
1
0
9h ago

CVE-2026-16635

Overview

pronamic
Pronamic Pay

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v3.1

HIGH (8.8)

EPSS

0.31%

MITRE

KEV

Description

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.

Statistics

1 Post
1 Interaction

Last activity: 8 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-16635 - Privilege Escalation in Pronamic Pay WordPress plugin. Auth Subscriber+ can set any role via Gravity Forms. CVSS 8.8. Unpatched - disable or restrict until fix. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-16635/

0
1
0
8h ago

CVE-2026-67333

Overview

better-auth
better-auth

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

MEDIUM (5.1)

EPSS

0.16%

MITRE

KEV

Description

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.

Statistics

1 Post
1 Interaction

Last activity: 5 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-67333 - High sev URL scheme bypass in Better-Auth. javascript: redirect_uri allows XSS on consent pages. CVSS 7.2. No patch yet, block untrusted clients now. #CVE #BetterAuth #infosec

https://www.valtersit.com/cve/CVE-2026-67333/

0
1
0
5h ago

CVE-2026-67297

Overview

FreeRDP
FreeRDP

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.34%

MITRE

KEV

Description

FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

Statistics

1 Post
1 Interaction

Last activity: 7 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-67297 - DoS in FreeRDP before 3.29.0. Malicious RD Gateway can send oversized chunked HTTP responses, exhausting client memory. CVSS 7.5. Unpatched - monitor for updates. #CVE #FreeRDP #infosec

https://www.valtersit.com/cve/CVE-2026-67297/

0
1
0
7h ago

CVE-2026-16144

Overview

wpchill
Kali Forms — Contact Form & Drag-and-Drop Builder

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

0.69%

MITRE

KEV

Description

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.

Statistics

1 Post
1 Interaction

Last activity: 20 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-16144 - Critical RCE in Kali Forms WordPress plugin. Unauthenticated code execution via call_user_func. CVSS 8.1. No patch available - disable plugin now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-16144/

0
1
0
20h ago

CVE-2026-67331

Overview

better-auth
scim

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

0.24%

MITRE

KEV

Description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Statistics

1 Post
1 Interaction

Last activity: 4 hours ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-67331 - Critical auth flaw in Better-Auth SCIM. Unbound providers let attackers steal tokens, hijack SCIM API access. CVSS 8.3. Unpatched - update immediately if affected. #CVE #infosec #BetterAuth

https://www.valtersit.com/cve/CVE-2026-67331/

0
1
0
4h ago

CVE-2026-67352

Overview

openwrt
luci

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

MEDIUM (6.8)

EPSS

0.21%

MITRE

KEV

Description

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

Statistics

1 Post

Last activity: 1 hour ago

Fediverse

Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-67352 - Stored XSS in Luci-App-Https-Dns-Proxy. Resolver_url injects HTML, runs JS in admin's browser. CVSS 7.6. No patch yet; restrict access. #CVE #infosec #XSS

https://www.valtersit.com/cve/CVE-2026-67352/

0
0
0
1h ago

CVE-2026-67336

Overview

better-auth
better-auth

01 Aug 2026

Published

01 Aug 2026

Updated

CVSS v4.0

CRITICAL (9.4)

EPSS

0.16%

MITRE

KEV

Description

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

Statistics

1 Post

Last activity: 19 hours ago

Fediverse

OffSequence @offseq

CVE-2026-67336: better-auth <1.6.11 uses insecure crypto defaults in oidcProvider & mcp, advertising 'none' algo & accepting plain PKCE. Exploitation can lead to unsigned tokens & code interception. Severity: CRITICAL. Patch to 1.6.11+ https://radar.offseq.com/threat/better-auth-versions-before-1611-contain-insecure-cryptographic-defaults-in-the-oidcprovider-and-mcp-eb22076a221f3a81 #OffSeq #CVE202667336 #OAuth #Security

0
0
0
19h ago

CVE-2025-66376

Overview

Zimbra
Collaboration

05 Jan 2026

Published

19 Mar 2026

Updated

CVSS v3.1

HIGH (7.2)

EPSS

21.62%

MITRE

KEV

Description

Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.

Statistics

1 Post

Last activity: 8 hours ago

Bluesky

CyberVeille @cyberveille-ch.bsky.social

📢 TA488 exploite une zero-day Zimbra (CVE-2025-66376) pour espionner des gouvernements via half-click 📝 ## 🔍 Contexte Publié le 23… https://cyberveille.ch/posts/2026-08-02-ta488-exploite-une-zero-day-zimbra-cve-2025-66376-pour-espionner-des-gouvernements-via-half-click/ #CVE_2025_66376 #Cyberveille

0
0
0
8h ago