Threat Intelligence Database

A critical vulnerability (CVE-2026-66066) in the Rails Active Storage framework allows unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE). The flaw is exploitable when the libvips image processing library is used and untrusted users can upload images. This can expose sensitive application files including secret keys and credentials. The vulnerability affects Active Storage versions before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1. Rails 6.x is affected only if Active Storage is configured outside defaults. Mitigations include upgrading libvips to 8.13 or later, applying Rails patches, rotating secrets, and temporarily disabling vulnerable functionality via environment variables. No workaround exists for libvips versions prior to 8.13. ImageMagick users are not affected. The Rails team withheld full technical details initially but later published them due to rapid exploit development. Akamai has released WAF protections to help defend against this threat.

A stored cross-site scripting (XSS) vulnerability exists in the luci-app-https-dns-proxy component of OpenWrt's luci interface. Authenticated users can inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the injected HTML is rendered and executes JavaScript in the administrator's browser context. This vulnerability has a CVSS 4.0 base score of 6.8, indicating medium severity. No patch or official remediation guidance is currently provided by the vendor. The vulnerability requires authenticated access and does not involve user interaction beyond the administrator viewing the status page.

ArcadeDB versions before 26.7.2 have a vulnerability where the UPDATE_SCHEMA permission is not enforced on certain ALTER TYPE SQL operations. This allows an authenticated user with only read access to modify schema metadata and bucket-selection strategy via the HTTP command endpoint, potentially corrupting schema and record routing. The vulnerability has a high severity with a CVSS score of 8.5. No patch or official remediation has been confirmed yet.

ArcadeDB versions prior to 26.7.2 expose the cluster token in cleartext via the GET /api/v1/server endpoint. Authenticated users can retrieve this sensitive token, which can then be used to impersonate root and perform administrative actions such as user creation, database operations, and server shutdown. This vulnerability has a high severity rating with a CVSS score of 8.7.

ArcadeDB versions prior to 26.7.2 have an authorization bypass vulnerability in several HTTP handlers. These handlers for time series, batch, Prometheus, and Grafana endpoints do not properly validate database access permissions. This flaw allows attackers to access and modify databases without proper authorization by invoking these endpoints with arbitrary database parameters. The vulnerability is rated critical with a CVSS score of 9.3.

ArcadeDB versions prior to 26.7.2 contain an authorization vulnerability in the SQL DEFINE FUNCTION statement when using JavaScript as the language. This flaw allows attackers with database access to execute arbitrary JavaScript code by bypassing scripting authorization checks. The vulnerability is critical with a CVSS score of 9.3 and affects all versions before 26.7.2.

ArcadeDB versions prior to 26.7.2 contain a critical vulnerability that allows authenticated users with UPDATE_SCHEMA permission to execute arbitrary OS commands via JavaScript triggers. This occurs because the ScriptTriggerExecutor component improperly allows trigger scripts to access java.lang.* classes, enabling invocation of dangerous methods like Runtime.getRuntime().exec(). This vulnerability can lead to full system compromise when triggers are fired.

A vulnerability in better-auth oauth-provider before version 1.7.0-beta.4 allows improper authorization by failing to bind the access-token audience to the authorization grant. This flaw enables clients to request tokens for resource servers not covered by the original authorization, potentially bypassing intended access controls. The issue affects version 1.4.8 specifically and has a medium severity rating with a CVSS score of 5.3.

CVE-2026-67331 is a high-severity authorization bypass vulnerability in better-auth SCIM affecting version 1.5.0. The issue arises because non-organization SCIM providers are not bound to their creator by default, allowing authenticated users to manage other users' providers. This enables attackers to regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes using attacker-controlled tokens.

A critical authorization bypass vulnerability exists in @better-auth/scim plugin versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9. The issue arises because SCIM token issuance does not reject provider IDs already used by other authentication providers, allowing an authenticated user to mint a SCIM token with a colliding provider ID. This enables unauthorized listing, reading, updating, and deleting of global user accounts and sessions, leading to account takeover and unauthorized deprovisioning. The vulnerability is fixed in versions 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).