| [CVE-2026-66066] Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untruste | Critical(9.5) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33168] Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in | Low(2.3) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33169] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to ins | Medium(6.9) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33170] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@h | Medium(5.3) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33173] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client | Medium(5.3) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33174] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the | Medium(6.6) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33176] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept stri | Medium(6.6) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33195] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the r | High(8) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33202] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys dire | Medium(6.6) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2026-33658] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte r | Low(2.3) | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Fixed · Fixed: 2:7.2.2.2+dfsg-2~deb13u2 nvd · rails · debian · 13
|
| [CVE-2010-3299] rails: CVE-2010-3299 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|
| [CVE-2017-17920] rails: CVE-2017-17920 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|
| [CVE-2017-17919] rails: CVE-2017-17919 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|
| [CVE-2017-17917] rails: CVE-2017-17917 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|
| [CVE-2017-17916] rails: CVE-2017-17916 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|
| [CVE-2011-3187] rails: CVE-2011-3187 | Low | AffectedDetails (3)2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u1 · all · trixie-security · Historical version
Affected dsa · rails · debian · 13 2:7.2.2.2+dfsg-2~deb13u2 · all · trixie-security
Affected dsa · rails · debian · 13
|