Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

The feed highlights multiple critical, remotely exploitable vulnerabilities and active attacks, including unauthenticated remote code execution in Ruflo, OpenWrt, TeamCity, and Gitea; authentication bypass in VMware vCenter and Check Point SmartConsole; arbitrary file disclosure in Ruby on Rails; and active exploitation of Arista VeloCloud Orchestrator. It also covers compromised npm packages, Android and Linux malware, attacks against water infrastructure, exposed BMC credentials, and AI-assisted exploitation. Organizations should prioritize patching actively exploited and internet-facing CVE