Skip to content
Sign in

rails product

Several products

Alert
No Several products CVE is in the CISA KEV catalogue.

Tracked since 30 Jul · latest article 31 Aug · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

1High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No Several products CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Several products CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Several products CVE to KEV.

Fix listed

0 of 1 CVE in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-66066: 98th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-6606698

Coverage7 articles · all time

The latest 7 articles naming Several products, in the shared story grammar.

Full timeline
Quiet for 8 weekslast report 31 Aug7 articles4 outlets

7 articles from 4 outlets since 30 Jul. Quiet since 31 Aug.

Now30 Jul1 Aug3431First reportSecurityOnline · 30 Jul, 04:31Picked up againafter 4 weeks quiet
  • Thu 30 Jul, 04:31 UTC. SecurityOnline, first report. Critical Rails flaw exposes files, risks RCE via CVE-2026-66066.
  • Thu 30 Jul, 16:59 UTC. Rapid7, its first report on the story. Critical Ruby on Rails Bug Exposes Files via Image Upload.
  • Sat 1 Aug, 11:25 UTC. SecurityOnline. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public.
  • Sat 1 Aug, 11:25 UTC. SecurityWeek, its first report on the story. Ruby on Rails Patches Critical Vulnerability.
  • Mon 3 Aug, 07:26 UTC. Security Affairs, its first report on the story. Ruby on Rails fixes critical Active Storage bug CVE-2026-66066.
  • Mon 3 Aug, 19:21 UTC. Rapid7. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails.
  • Mon 31 Aug, 11:29 UTC. SecurityWeek. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Thu 30 JulDay 02
    1. Critical Rails flaw exposes files, risks RCE via CVE-2026-6606604:31 · SecurityOnline · First report
    2. Critical Ruby on Rails Bug Exposes Files via Image Upload16:59 · Rapid7

  2. Quiet for 2 days

    Sat 1 AugDay 22
    1. CVE-2026-66066: Rails Active Storage RCE Exploit Code Now Public11:25 · SecurityOnline
    2. Ruby on Rails Patches Critical Vulnerability11:25 · SecurityWeek

  3. Quiet for 2 days

    Mon 3 AugDay 42
    1. Ruby on Rails fixes critical Active Storage bug CVE-2026-6606607:26 · Security Affairs
    2. CVE-2026-66066 flaw lets attackers read files in Ruby on Rails19:21 · Rapid7

  4. Quiet for 4 weeks

    Mon 31 AugDay 321
    1. CVE-2026-66066 Ruby on Rails Flaw Triggers Remote Code Execution11:29 · SecurityWeek · Picked up again

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-66066

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    9.5Critical27% EPSS · 7 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in