CVE Watch10 nov 2026

CVE-2026-126085

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1

CVSS

5.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-602

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-118795—

3.2%

——1Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.2d CVE-2026-1123694.3 MED

5.9%

——2IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.3d CVE-2026-122148—

8.3%

——2In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.5d CVE-2026-1197465.9 MED

38.1%

——11ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.6d CVE-2026-89293—

40.1%

——12In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.7d CVE-2026-1175544.3 MED

21.7%

——7Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.9d