diff --git a/gems/actionmailbox/GHSA-5957-c7qm-m469.yml b/gems/actionmailbox/GHSA-5957-c7qm-m469.yml
new file mode 100644
index 0000000000..4268c1cbef
--- /dev/null
+++ b/gems/actionmailbox/GHSA-5957-c7qm-m469.yml
@@ -0,0 +1,61 @@
+---
+gem: actionmailbox
+framework: rails
+ghsa: 5957-c7qm-m469
+url: https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469
+title: "Possible signature replay in Action Mailbox Mailgun ingress"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the
+  `timestamp` and `token` parameters concatenated without a separator, and
+  `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?`
+  rejects only timestamps more than 2 minutes in the past. Because the signature
+  does not fix the boundary between the two values, a captured signed request
+  can be presented with a timestamp far in the future, which the ingress then
+  accepts indefinitely. An attacker who obtains one signed Mailgun webhook
+  request, but not the signing key, could submit arbitrary inbound email that
+  Action Mailbox processes as genuine, possibly leading to forged messages
+  attributed to the sender of the attacker's choosing.
+
+  Applications that receive inbound email through the Action Mailbox Mailgun
+  ingress are affected.
+
+  ### Details
+
+  The fixed releases also reject a Mailgun request whose timestamp is more than
+  2 minutes ahead of the server's clock, as they already did for one more than 2
+  minutes behind it. An application whose clock runs more than 2 minutes behind
+  Mailgun's will now reject genuine webhooks and should synchronize its clock.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [davutselcuk](https://hackerone.com/davutselcuk).
+cvss_v3: 3.7
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionmailbox/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionmailbox/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a
+    - https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34
+    - https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-2586-8ghr-69fj.yml b/gems/actionpack/GHSA-2586-8ghr-69fj.yml
new file mode 100644
index 0000000000..f932a2fb9b
--- /dev/null
+++ b/gems/actionpack/GHSA-2586-8ghr-69fj.yml
@@ -0,0 +1,62 @@
+---
+gem: actionpack
+framework: rails
+ghsa: 2586-8ghr-69fj
+url: https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
+title: "Possible restoration of destroyed sessions in Action Dispatch
+  CacheStore"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActionDispatch::Session::CacheStore` writes a session back to the cache at
+  the end of each request that loaded it, without checking that the session's
+  cache entry still exists. When a concurrent request destroys the session,
+  through `reset_session` on logout or by deleting its cache entry on the
+  server, a request that loaded the session earlier and finishes later restores
+  it under its original session ID. Logout and server-side revocation could
+  therefore fail to end a session, and an attacker who holds a stolen session
+  cookie could keep that session valid across the victim's logout.
+
+  Applications that use `config.session_store :cache_store` are affected, with
+  any cache backend. `ActionDispatch::Session::CookieStore` is not affected, nor
+  is `ActionDispatch::Session::MemCacheStore` with Dalli 4.0.0 or later, whose
+  session store does not write back a session that was deleted.
+
+  ### Details
+
+  The fixed releases record which session a request loaded and skip the write
+  when that session's cache entry no longer exists. Changes that such a request
+  makes to the destroyed session are discarded, and Rack logs a warning that the
+  session could not be saved. Each request that writes back a session it loaded
+  makes one additional cache read.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5.patch
+
+  ### Credit
+
+  Found by the team during internal code review.
+cvss_v3: 4.2
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f
+    - https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5
+    - https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-2gff-2mmg-m73p.yml b/gems/actionpack/GHSA-2gff-2mmg-m73p.yml
new file mode 100644
index 0000000000..a629ec0506
--- /dev/null
+++ b/gems/actionpack/GHSA-2gff-2mmg-m73p.yml
@@ -0,0 +1,99 @@
+---
+gem: actionpack
+framework: rails
+ghsa: 2gff-2mmg-m73p
+url: https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p
+title: "Possible IP spoofing in Action Dispatch RemoteIp"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from
+  `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239
+  `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy
+  appends the client address to `X-Forwarded-For` but passes a client-supplied
+  `Forwarded` header through unchanged, `request.remote_ip` returns an address
+  chosen by the client, and the IP spoofing check does not raise, because it
+  compares only `Client-Ip` with the forwarded addresses. An unauthenticated
+  attacker could therefore spoof `request.remote_ip`, possibly bypassing
+  IP-based access controls and rate limits keyed on the client address
+  (including the default `by:` of `rate_limit`), and falsifying the client
+  address in logs.
+
+  ### Details
+
+  The 8.1.0 change
+  ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d))
+  switched `ActionDispatch::RemoteIp` from reading `X-Forwarded-For` directly to
+  Rack's `forwarded_for`, in order to reuse Rack's port handling. Rails
+  continues to honor `Forwarded`, the standard header.
+
+  In the fixed releases, when `config.action_dispatch.ip_spoofing_check` is
+  enabled (the default), `ActionDispatch::RemoteIp` also compares the first
+  untrusted client address in `Forwarded` with the first untrusted client
+  address in `X-Forwarded-For`, as exact strings, and raises
+  `ActionDispatch::RemoteIp::IpSpoofAttackError` when both headers are present
+  and the addresses differ. Deployments whose proxies report the client address
+  inconsistently between the two headers will receive this error after
+  upgrading. See the `actionpack` CHANGELOG.
+
+  ### Affected applications
+
+  An application is affected if it meets all of these requirements:
+  - Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, `forwarded_for`
+    reads only `X-Forwarded-For`.
+  - Is served behind a proxy that does not remove or overwrite a client-supplied
+    `Forwarded` header.
+  - Relies on `request.remote_ip` for access control, rate limiting, or
+    auditing.
+
+  The fix detects a spoofed `Forwarded` header only when the proxy also sets
+  `X-Forwarded-For`. An application whose proxy passes a client-supplied
+  `Forwarded` header through and sets no `X-Forwarded-For` remains exposed after
+  upgrading, and should configure the proxy to remove or overwrite `Forwarded`,
+  or apply the workaround below.
+
+  ### Mitigation
+
+  - Upgrade to a fixed version of `actionpack`.
+  - Configure reverse proxies to remove or overwrite any client-supplied
+    `Forwarded` header.
+
+  ### Workarounds
+
+  Applications whose proxies set `X-Forwarded-For` can make Rack ignore the
+  `Forwarded` header, restoring the client address resolution of Rails 8.0, by
+  setting `Rack::Request.forwarded_priority = [:x_forwarded]` in an initializer.
+  This setting is available in Rack 3.0.0 and later, and it also causes Rack to
+  ignore `Forwarded` when determining the request scheme, host, and port.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227.patch
+
+  ### Versions affected
+
+  - actionpack >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [luryus](https://hackerone.com/luryus).
+cvss_v3: 7.4
+unaffected_versions:
+  - "< 8.1.0"
+patched_versions:
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227
+    - https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml b/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml
new file mode 100644
index 0000000000..4dc471dc9b
--- /dev/null
+++ b/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml
@@ -0,0 +1,68 @@
+---
+gem: actionpack
+framework: rails
+ghsa: gmj8-hvj3-49mw
+url: https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw
+title: "Missing SameSite attribute on session cookies from Action Pack session
+  stores"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Action Pack session stores other than `ActionDispatch::Session::CookieStore`
+  (`CacheStore`, `MemCacheStore`, and third-party stores built on
+  `AbstractStore`, `AbstractSecureStore` or the session mixins) write the
+  session cookie without a `SameSite` attribute, regardless of
+  `config.action_dispatch.cookies_same_site_protection`, which defaults to
+  `:lax`. Only `CookieStore` applies the configured policy. In browsers that do
+  not treat a cookie without the attribute as `SameSite=Lax`, a cross-site
+  request could carry the session cookie, possibly leading to cross-site request
+  forgery against actions that do not verify an authenticity token, such as
+  those of API-only applications.
+
+  Applications are affected when they use a session store other than
+  `CookieStore` and do not pass `same_site:` to `config.session_store`.
+
+  ### Details
+
+  In the fixed releases, every session store sets the session cookie's
+  `SameSite` attribute from `cookies_same_site_protection` when its options have
+  no `:same_site` key. An explicit `same_site:` option, including
+  `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS`
+  still take precedence.
+
+  ### Workarounds
+
+  Pass `same_site:` when configuring the session store, for example
+  `config.session_store :cache_store, same_site: :lax`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [tjvc](https://hackerone.com/tjvc).
+cvss_v3: 3.1
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46
+    - https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef
+    - https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml b/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml
new file mode 100644
index 0000000000..5a890b9dee
--- /dev/null
+++ b/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml
@@ -0,0 +1,75 @@
+---
+gem: actionpack
+framework: rails
+ghsa: r9jg-fmfx-2gv6
+url: https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6
+title: "Possible cache poisoning in Action Pack content negotiation"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Action Pack negotiates the format of a rendered response from the `Accept`,
+  `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type`
+  request headers, but `ActionController::Rendering#_set_vary_header` adds
+  `Vary: Accept` only when the request carries a usable `Accept` header and the
+  response has no `Vary` header yet. A response to a request without `Accept`,
+  or to an XHR request, therefore omits the headers that selected its
+  representation, and a response whose `Vary` the application set before
+  rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared
+  cache that honours `Vary` could store such a response and serve it to later
+  clients that request a different representation, possibly leading to cache
+  poisoning in which visitors receive, until the entry expires, a page without
+  its layout or HTML in place of JSON. The attacker cannot choose the content of
+  the response.
+
+  Applications that render negotiated responses from actions marked `public`
+  (for example with `expires_in ..., public: true`) behind a shared cache that
+  honours `Vary`, such as Thruster or `Rack::Cache`, are affected.
+
+  ### Details
+
+  In the fixed releases, a rendered response whose format is not given by the
+  URL lists `Accept` and `X-Requested-With` in `Vary`, and also `Content-Type`
+  for an XHR request without `Accept`; when
+  `config.action_dispatch.ignore_accept_header` is enabled, it lists only
+  `X-Requested-With`. These fields are appended to an existing `Vary` value
+  rather than skipped, and `Vary: *` is left unchanged. Shared caches can store
+  more variants of such responses than before. See the Action Pack CHANGELOG for
+  details.
+
+  ### Workarounds
+
+  Set `Vary: Accept, X-Requested-With` on negotiated responses in the
+  application, for example in an `after_action`, or do not mark negotiated
+  responses `public`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-7GHGLQGO,
+  ANT-2026-5MT6C2R3).
+cvss_v3: 4.8
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b
+    - https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c
+    - https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml b/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml
new file mode 100644
index 0000000000..a184f248f4
--- /dev/null
+++ b/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml
@@ -0,0 +1,51 @@
+---
+gem: actionpack
+framework: rails
+ghsa: rwvh-fw6r-pwvp
+url: https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp
+title: "Possible DoS vulnerability in Action Controller Live streaming"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActionController::Live::Buffer#close` pushes its end-of-stream marker onto
+  the response's bounded queue while it holds the buffer's monitor. When the
+  client has stopped reading and the queue is full, the push blocks, and
+  `Buffer#abort`, which runs when the client disconnects or a write times out,
+  waits indefinitely for the same monitor. Each such response could permanently
+  hold a web server thread and its `ActionController::Live` thread, possibly
+  resulting in a DoS vulnerability through thread exhaustion.
+
+  Applications that stream responses with `ActionController::Live`, including
+  `send_stream`, are affected. Applications that serve large files through
+  Active Storage proxy mode are exposed to unauthenticated clients.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).
+cvss_v3: 5.9
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc
+    - https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215
+    - https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml b/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml
new file mode 100644
index 0000000000..7dbf125a31
--- /dev/null
+++ b/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml
@@ -0,0 +1,79 @@
+---
+gem: actionpack
+framework: rails
+ghsa: wm3x-v3qw-4jh3
+url: https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3
+title: "Possible Strong Parameters bypass in Parameters#each_key in Action Pack"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActionController::Parameters#each_key` delegates to the internal
+  `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters,
+  so when called with a block it returns that hash instead of the `Parameters`
+  instance. The hash does not respond to `permitted?`, so Active Model mass
+  assignment (`new`, `assign_attributes`, `update`) accepts it without raising
+  `ActiveModel::ForbiddenAttributesError`. An application that passes the return
+  value of `each_key` to mass assignment could allow a remote, unauthenticated
+  attacker to set attributes that the application does not permit, such as an
+  authorization flag.
+
+  This is an incomplete fix of
+  [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made
+  `each`, `each_pair` and `each_value` return the `Parameters` instance but left
+  `each_key` delegated.
+
+  ### Details
+
+  The fixed releases define `Parameters#each_key` to yield each key and return
+  the `Parameters` instance when given a block, as `each`, `each_pair` and
+  `each_value` do, and to return an `Enumerator` without one. Code that used the
+  return value of `each_key` as a hash now receives the `Parameters` instance,
+  which mass assignment rejects unless it is permitted.
+
+  ### Affected applications
+
+  An application is affected if it passes the return value of
+  `ActionController::Parameters#each_key`, called with a block, to mass
+  assignment. Rails itself makes no such call.
+
+  ### Workarounds
+
+  Do not use the return value of `each_key`. Call it for its block only, and
+  pass the permitted `Parameters` instance to mass assignment.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c.patch
+
+  ### Versions affected
+
+  - actionpack < 8.0.5.2
+  - actionpack >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [smlee](https://hackerone.com/smlee).
+cvss_v3: 7.5
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac
+    - https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c
+    - https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml b/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml
new file mode 100644
index 0000000000..9082a8fe77
--- /dev/null
+++ b/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml
@@ -0,0 +1,74 @@
+---
+gem: actionpack
+framework: rails
+ghsa: x6mj-8jx9-qhqv
+url: https://github.com/rails/rails/security/advisories/GHSA-x6mj-8jx9-qhqv
+title: "Possible sensitive session information leak in Active Storage proxy
+  mode"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  When `ActionDispatch::Cookies` reads a signed or encrypted cookie that was
+  written under a rotated secret (`config.action_dispatch.cookies_rotations`) or
+  in the format that a `:hybrid` cookie serializer migrates from, it writes the
+  cookie back to the response in the current format, and that write ignores
+  `request.session_options[:skip]`. `ActiveStorage::DisableSession` relies on
+  that option to keep the session cookie off the public, immutable responses of
+  the Active Storage proxy controllers, but those controllers still load the
+  session, so a request carrying an old-format session cookie could receive the
+  rewritten session cookie in `Set-Cookie` on a cacheable response. A shared
+  cache that stores such a response together with its `Set-Cookie` header could
+  then serve one user's session to later requesters of the same URL, or serve an
+  attacker's session to other users.
+
+  Applications are affected when they serve Active Storage files through the
+  proxy controllers, have a cookie rotation or a `:hybrid` serializer migration
+  configured, and run behind a cache that stores `Set-Cookie` on public
+  responses. This is a path around the fix for
+  [CVE-2024-26144](https://github.com/advisories/GHSA-8h22-8cf7-hq6g).
+
+  ### Details
+
+  In the fixed releases, a response that skips the session leaves an old-format
+  signed or encrypted cookie unchanged, and the next request that does not skip
+  the session upgrades it. An application that skips the session on every
+  request no longer upgrades its signed or encrypted cookies. Cookies that the
+  application sets explicitly are still written. See the Action Pack CHANGELOG.
+
+  ### Workarounds
+
+  Configure caching proxies not to store responses that carry a `Set-Cookie`
+  header, or complete the cookie rotation or serializer migration and remove it
+  from the configuration.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [flashmyname](https://hackerone.com/flashmyname).
+cvss_v3: 6.8
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556
+    - https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3
+    - https://github.com/rails/rails/security/advisories/GHSA-x6mj-8jx9-qhqv
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml b/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml
new file mode 100644
index 0000000000..0b3a7a5125
--- /dev/null
+++ b/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml
@@ -0,0 +1,67 @@
+---
+gem: actionview
+framework: rails
+ghsa: 2p2f-4rq4-gjwc
+url: https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc
+title: "Possible XSS vulnerability in Action View text helpers"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  With the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on
+  CRuby for applications using `load_defaults 7.1` or later), Nokogiri before
+  1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action
+  View text helpers `highlight` and `simple_format` sanitize their input and
+  then process the resulting HTML as a string: `highlight` splits it on tag
+  boundaries to insert matches, and `simple_format` splits it into paragraphs on
+  blank lines. An unescaped `>` or a blank line inside an attribute value could
+  cause markup in that value, which the sanitizer left inert, to be emitted as
+  live elements in the helper's `html_safe` output, possibly leading to XSS.
+  Applications that use the HTML5 sanitizer and pass untrusted text to
+  `highlight`, or to `simple_format` with `html_options`, are affected.
+
+  ### Details
+
+  The fixed releases require rails-html-sanitizer 1.7.2 or later, which requires
+  Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer
+  escapes `<` and `>` in attribute values as `&lt;` and `&gt;`, as the HTML4
+  sanitizer already does. The parsed DOM is unchanged, but code or tests that
+  compare sanitized HTML as a string may see the new serialization.
+
+  ### Workarounds
+
+  Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer,
+  so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by
+  setting `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [azaran](https://hackerone.com/azaran).
+  This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).
+cvss_v3: 6.1
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionview/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionview/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73
+    - https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11
+    - https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionview/GHSA-68p9-83h6-5wpj.yml b/gems/actionview/GHSA-68p9-83h6-5wpj.yml
new file mode 100644
index 0000000000..4ef8e96612
--- /dev/null
+++ b/gems/actionview/GHSA-68p9-83h6-5wpj.yml
@@ -0,0 +1,53 @@
+---
+gem: actionview
+framework: rails
+ghsa: 68p9-83h6-5wpj
+url: https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj
+title: "Possible XSS vulnerability in Action View tag helpers"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  The fix for
+  [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq)
+  skips blank HTML attribute names in Action View tag helpers, but it tests the
+  name before converting it to a string. A Symbol name made only of whitespace,
+  such as `:" "`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so
+  it reaches the attribute escaping, which emits an attribute with no name and
+  produces malformed HTML. The asset tag helpers, such as `image_tag`,
+  `video_tag` and `audio_tag`, symbolize their options, so a whitespace String
+  name passed to them takes the same path. A carefully crafted attribute value
+  could then be misinterpreted by the browser as a separate attribute name,
+  possibly leading to XSS. Applications that allow users to specify custom HTML
+  attribute names are affected.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [thepo1es](https://hackerone.com/thepo1es).
+cvss_v3: 4.7
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionview/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionview/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8
+    - https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4
+    - https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionview/GHSA-rq8q-p985-fjq7.yml b/gems/actionview/GHSA-rq8q-p985-fjq7.yml
new file mode 100644
index 0000000000..272b891205
--- /dev/null
+++ b/gems/actionview/GHSA-rq8q-p985-fjq7.yml
@@ -0,0 +1,63 @@
+---
+gem: actionview
+framework: rails
+ghsa: rq8q-p985-fjq7
+url: https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7
+title: "Possible XSS vulnerability in Action View strip_tags"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `strip_tags` in Action View returns its sanitized output marked `html_safe`,
+  but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and
+  `'` unencoded. Because ERB does not escape a string marked `html_safe`,
+  untrusted input passed through `strip_tags` and rendered inside a quoted HTML
+  attribute value could close the attribute and add new attributes, possibly
+  leading to XSS. Applications that render `strip_tags` output from untrusted
+  input inside an HTML attribute, for example in a `title` attribute or a
+  `<meta content>` tag, are affected. Output rendered as element content is not
+  affected.
+
+  ### Details
+
+  `strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<` and
+  `>`, without double-encoding existing entities. Applications that use
+  `strip_tags` output outside HTML, such as in a text template or JSON, now see
+  `&quot;` and `&#39;` where they saw `"` and `'`; `CGI.unescapeHTML` decodes
+  them. See the Action View CHANGELOG.
+
+  ### Workarounds
+
+  Pass `strip_tags` output to an attribute through a tag helper, which escapes
+  attribute values, for example `tag.a(title: strip_tags(user_input))`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [lucasluitjes](https://hackerone.com/lucasluitjes).
+cvss_v3: 6.1
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionview/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionview/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7
+    - https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59
+    - https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/actionview/GHSA-v6rj-xm57-3p59.yml b/gems/actionview/GHSA-v6rj-xm57-3p59.yml
new file mode 100644
index 0000000000..38f1cf82f5
--- /dev/null
+++ b/gems/actionview/GHSA-v6rj-xm57-3p59.yml
@@ -0,0 +1,67 @@
+---
+gem: actionview
+framework: rails
+ghsa: v6rj-xm57-3p59
+url: https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59
+title: "Possible XSS vulnerability in Action View highlight helper"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase
+  into the `:highlighter` string without escaping it and returns the result
+  marked HTML-safe. Because sanitizing leaves quote characters in text
+  unescaped, a match substituted into a quoted attribute value of the
+  highlighter, such as the `<a href="search?q=\1">` form shown in the method's
+  documentation, could end the attribute value and add attributes to the
+  element, possibly leading to XSS. Applications are affected when they pass a
+  `:highlighter` that places a placeholder inside an attribute value and
+  highlight text or phrases that a user controls. The default `<mark>\1</mark>`
+  highlighter and the block form are not affected.
+
+  ### Details
+
+  The fixed releases HTML-escape each group substituted into the `:highlighter`
+  string, so quotes in a match are rendered as `&quot;` and `&#39;`. Only the
+  numbered placeholders `\0` to `\9` are expanded; other `String#sub`
+  replacement escapes, such as `\k<name>`, `\&` and `\\`, are left as written. A
+  match can no longer begin on the `>` that closes a preceding tag. Escaping
+  makes a placeholder safe as element content or inside a quoted attribute
+  value, but not in an unquoted attribute value, a URL, JavaScript or CSS
+  context, or an attribute whose value is HTML. See the Action View CHANGELOG
+  for details.
+
+  ### Workarounds
+
+  Use a `:highlighter` that places the matched phrase only in element content,
+  such as the default `<mark>\1</mark>`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).
+cvss_v3: 6.1
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionview/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionview/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425
+    - https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a
+    - https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml b/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml
new file mode 100644
index 0000000000..63dddde7d9
--- /dev/null
+++ b/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml
@@ -0,0 +1,71 @@
+---
+gem: activestorage
+framework: rails
+ghsa: 3f4q-8x5m-76v8
+url: https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8
+title: "Possible local file disclosure in Active Storage video previews and
+  analysis"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Active Storage's `VideoPreviewer`, `VideoAnalyzer` and `AudioAnalyzer` run
+  `ffmpeg` and `ffprobe` on a blob's contents without restricting the input
+  format, so FFmpeg selects a demuxer by probing the file. A blob created
+  through a direct upload keeps the content type the client declared, so a
+  client can store an HLS playlist under a `video/*` or `audio/*` type. When
+  that blob is previewed or analyzed, the `hls` demuxer opens the `file://`
+  segments that the playlist names, and the preview image or the stored metadata
+  could disclose a local media file that the application process can read and
+  whose path the attacker knows.
+
+  Applications that accept uploads from untrusted users and generate video
+  previews, or analyze video or audio attachments with FFmpeg, are affected.
+
+  ### Details
+
+  The fixed releases limit the formats FFmpeg may open to common audio and video
+  containers, configured by the new
+  `config.active_storage.ffmpeg_allowed_formats` setting. Files in other formats
+  no longer preview or receive media metadata; the Active Storage CHANGELOG
+  names some of them and shows how to add a format to the list.
+
+  ### Workarounds
+
+  Applications that cannot upgrade can stop Active Storage from running FFmpeg
+  on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from
+  `config.active_storage.previewers`, and
+  `ActiveStorage::Analyzer::VideoAnalyzer` and
+  `ActiveStorage::Analyzer::AudioAnalyzer` from
+  `config.active_storage.analyzers`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [w3rmut](https://hackerone.com/w3rmut).
+cvss_v3: 3.7
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282
+    - https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b
+    - https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-3w93-6hmw-whh4.yml b/gems/activestorage/GHSA-3w93-6hmw-whh4.yml
new file mode 100644
index 0000000000..b341979483
--- /dev/null
+++ b/gems/activestorage/GHSA-3w93-6hmw-whh4.yml
@@ -0,0 +1,72 @@
+---
+gem: activestorage
+framework: rails
+ghsa: 3w93-6hmw-whh4
+url: https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4
+title: "Unsigned Content-Type in Active Storage GCS direct uploads with
+  cache_control"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  When a GCS service is configured with the `cache_control` option,
+  `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload
+  URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host`
+  headers. A direct-upload client can therefore send a `Content-Type` of its
+  choosing, and can omit the declared `Content-MD5`, without invalidating the
+  URL. GCS stores the supplied content type as object metadata, which takes
+  precedence over the `response-content-type` that Active Storage sets on
+  download URLs, so an uploaded object could be served as inline HTML under the
+  application's bucket path on `storage.googleapis.com`. Script in such an
+  object runs on the storage origin rather than the application's, but could
+  register a Service Worker scoped to the bucket path and read or replace a
+  victim's later responses for signed URLs in that bucket.
+
+  Applications that use the GCS service with `cache_control` configured and
+  accept direct uploads are affected. GCS services without `cache_control` sign
+  with V2 and are not affected.
+
+  ### Details
+
+  The fixed releases sign every GCS direct-upload URL with V2, which binds an
+  empty `Content-Type` and the declared `Content-MD5`. The configured
+  `Cache-Control` is still returned by `headers_for_direct_upload` and sent by
+  the client, but it is no longer part of the signature, and direct-upload URLs
+  for these services are no longer limited to V4's seven-day maximum expiry. See
+  the Active Storage CHANGELOG.
+
+  ### Workarounds
+
+  Removing the `cache_control` option from the GCS service configuration makes
+  Active Storage sign direct uploads with V2.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [thepo1es](https://hackerone.com/thepo1es).
+cvss_v3: 4.7
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1
+    - https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614
+    - https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml b/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml
new file mode 100644
index 0000000000..7a27de1b07
--- /dev/null
+++ b/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml
@@ -0,0 +1,67 @@
+---
+gem: activestorage
+framework: rails
+ghsa: 4v2w-w6g6-f8f8
+url: https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8
+title: "Possible DoS vulnerability in Active Storage proxy mode via storage
+  errors during streaming"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  When Active Storage serves a file through its proxy controllers,
+  `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage
+  service by calling `head` to send a 404 or 500 response. If the error occurs
+  after the first chunk has been written, the response is already committed, and
+  `head` replaces the response body while the server is still reading the
+  original `ActionController::Live` buffer. That buffer is never closed, so the
+  server thread handling the request blocks until the process restarts. Repeated
+  failed downloads could exhaust the server's threads, possibly resulting in a
+  DoS vulnerability.
+
+  Applications are affected when they store files on a service that streams a
+  download in several requests, such as Amazon S3, an S3-compatible service or
+  Google Cloud Storage, and draw Active Storage's default routes. The proxy
+  routes are drawn whether or not proxy mode is the default for the application.
+  A file deleted while it is being served, or any other storage error partway
+  through a download, triggers the condition.
+
+  ### Details
+
+  A storage error raised before the response is committed still produces a 404
+  or 500 response. After the fix, a storage error raised after the response is
+  committed is re-raised instead, so the server closes the streamed response and
+  releases the thread; the client receives a truncated body, and the exception
+  reaches the application's error reporting.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB).
+cvss_v3: 5.3
+unaffected_versions:
+  - "< 8.0.0"
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009
+    - https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82
+    - https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-f3w6-w445-fwh9.yml b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml
new file mode 100644
index 0000000000..068a5dccdb
--- /dev/null
+++ b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml
@@ -0,0 +1,121 @@
+---
+gem: activestorage
+framework: rails
+ghsa: f3w6-w445-fwh9
+url: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
+title: "Possible arbitrary file write and read in Active Storage image analysis"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  A Rails application that processes attachments with ImageMagick may allow an
+  unauthenticated attacker to write arbitrary files on the server and, when
+  attachments are stored with the Disk service, to read arbitrary files readable
+  by the application process. Those files typically include `secret_key_base`
+  and credentials for external systems, which may in turn allow escalation to
+  remote code execution or lateral movement to those systems.
+
+  ### Details
+
+  ImageMagick selects a coder from the content of the file it is given, and some
+  coders act on files named inside the image rather than on the image itself.
+  Active Storage constrained none of ImageMagick's coders, and the ImageMagick
+  analyzer runs when a file is attached, so an attacker who can upload a crafted
+  file may be able to invoke one. Attaching the upload is sufficient; no
+  variant, preview, or `analyze` call is required. One specific attack chain has
+  been reported to us, but we do not assume it is the only one that exists.
+
+  The fixed versions ship an ImageMagick security policy and prepend its
+  directory to `MAGICK_CONFIGURE_PATH` through `MiniMagick.cli_env`, so every
+  ImageMagick process that MiniMagick spawns applies it. The policy denies the
+  `MSL` scripting coder, the coders that read or delete files other than the
+  image, fetch remote or local references, or display to a screen, every coder
+  backed by Ghostscript together with the `gs` delegate, and `@filename`
+  indirection. ImageMagick applies every `policy.xml` on its search path, so the
+  shipped policy adds to the host's policy rather than replacing it. The policy
+  applies to every ImageMagick command that MiniMagick runs, not only those of
+  Active Storage. See the `activestorage` CHANGELOG and "ImageMagick Security
+  Policy" in the Active Storage guide.
+
+  ### Affected applications
+
+  An application is affected if it meets all of these requirements:
+  - Uses ImageMagick for Active Storage image processing. This is
+    `config.active_storage.variant_processor = :mini_magick`, which is the
+    default for applications on `load_defaults 6.1` or earlier.
+  - Runs ImageMagick under a security policy that does not already deny the
+    coders involved. The policies that Debian and Ubuntu package do not.
+  - Allows file uploads from untrusted users.
+
+  ### Mitigation
+
+  - Upgrade to a fixed version of `activestorage`.
+  - An application whose variant processor is `:mini_magick` must use
+    mini_magick `>= 5.1`, which applying the policy requires. With an older
+    mini_magick, such an application raises an exception during boot.
+  - An application that renders PostScript or PDF through ImageMagick must
+    re-allow the `gs` delegate and the coders it uses in the host's
+    `policy.xml`.
+  - An application that replaces `MiniMagick.cli_env` after boot, clears the
+    environment with `MiniMagick.cli_prefix`, or installs its own
+    `MiniMagick::Shell` does not receive the shipped policy and must carry its
+    rules in ImageMagick's system policy. GraphicsMagick does not read
+    ImageMagick policies.
+  - If attachments are stored with the Disk service, change `secret_key_base`
+    and every secret readable by the application process, including the master
+    key and everything `config/credentials.yml.enc` holds, storage and database
+    credentials, and third-party tokens. Do not retain an exposed secret as a
+    fallback.
+
+  ### Workarounds
+
+  Copy the rules of the policy that the fixed versions ship,
+  `activestorage/lib/active_storage/image_magick/policy.xml`, into ImageMagick's
+  system policy, for example `/etc/ImageMagick-7/policy.xml`. At a minimum, deny
+  the `MSL` coder, the Ghostscript coders, and the `gs` delegate:
+
+  ```xml
+  <policy domain="coder" rights="none" pattern="MSL"/>
+  <policy domain="delegate" rights="none" pattern="gs"/>
+  <policy domain="coder" rights="none" pattern="{PS,PS2,PS3,EPS,EPS2,EPS3,EPI,EPSF,EPSI,EPT,EPT2,EPT3,PDF,AI,EPDF,PDFA,POCKETMOD,XPS,PCL}"/>
+  ```
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328
+  - 8.0:
+    https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776
+
+  ### Versions affected
+
+  - activestorage < 8.0.5.2
+  - activestorage >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [ryotak](https://hackerone.com/ryotak).
+
+  ### References
+
+  - ImageMagick [security policy](https://imagemagick.org/security-policy/)
+cvss_v3: 9.8
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328
+    - https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776
+    - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml b/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml
new file mode 100644
index 0000000000..efba5b37fd
--- /dev/null
+++ b/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml
@@ -0,0 +1,63 @@
+---
+gem: activestorage
+framework: rails
+ghsa: hfr4-8rjc-97m2
+url: https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2
+title: "Possible circumvention of file size limits in Active Storage direct
+  uploads to Google Cloud Storage"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the
+  declared content length into the signed direct-upload URL, and
+  `#headers_for_direct_upload` returns no length constraint, so the URL
+  authorizes an upload body of any size. A direct-upload client could store a
+  file larger than the `byte_size` it declared, and the resulting blob keeps the
+  declared size, possibly bypassing application file size validations and
+  quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service.
+
+  Applications that store files in Google Cloud Storage and accept direct
+  uploads are affected.
+
+  ### Details
+
+  The fixed releases sign an `x-goog-content-length-range` header that matches
+  the blob's declared `byte_size` and return it from
+  `headers_for_direct_upload`, so Cloud Storage rejects an upload body of any
+  other size. Browsers send this header with the direct upload, so a bucket's
+  CORS configuration must list `x-goog-content-length-range` in
+  `responseHeader`, or browser direct uploads fail after the upgrade. The Active
+  Storage CHANGELOG and the CORS example in the Active Storage guide show the
+  change.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [f4cts](https://hackerone.com/f4cts).
+cvss_v3: 5.3
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7
+    - https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c
+    - https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml b/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml
new file mode 100644
index 0000000000..9e512548a3
--- /dev/null
+++ b/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml
@@ -0,0 +1,62 @@
+---
+gem: activestorage
+framework: rails
+ghsa: p2pm-g2h6-7j5j
+url: https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j
+title: "Possible DoS vulnerability in Active Storage filename handling"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore
+  `#extension`, pass the stored filename unmodified to `File.basename` and
+  `File.extname`, which raise `ArgumentError` when the name contains a NUL byte.
+  Active Storage stores the client-supplied filename verbatim, so a user who is
+  permitted to upload an attachment could persist such a filename on databases
+  that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB.
+  Each subsequent request that builds a variant or preview of the blob, opens
+  it, or renders it as an Action Text attachment then raises, possibly resulting
+  in a persistent DoS vulnerability for the pages that display the blob until it
+  is purged or its filename is corrected. Applications that use PostgreSQL are
+  not affected, because PostgreSQL rejects the row.
+
+  ### Details
+
+  `Filename#base` and `#extension_with_delimiter` now derive from
+  `Filename#sanitized`, the form that `Filename#to_s` and the
+  `Content-Disposition` header already use. For a filename that `#sanitized`
+  changes, such as one containing a NUL byte, an invalid byte sequence, a path
+  separator or another replaced character, the base and extension now agree with
+  `#to_s`; the variant format inferred from such a name may change, and an
+  existing variant may be regenerated once. Stored filenames are not modified,
+  and no data migration is required.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-UQM5Z4YL).
+cvss_v3: 4.3
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692
+    - https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a
+    - https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activestorage/GHSA-v924-7rp8-4mxh.yml b/gems/activestorage/GHSA-v924-7rp8-4mxh.yml
new file mode 100644
index 0000000000..51e8c56c66
--- /dev/null
+++ b/gems/activestorage/GHSA-v924-7rp8-4mxh.yml
@@ -0,0 +1,111 @@
+---
+gem: activestorage
+framework: rails
+ghsa: v924-7rp8-4mxh
+url: https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh
+title: "Possible arbitrary file read and remote code execution in Active
+  Storage video previews, analysis and image processing"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the
+  extension of the uploaded filename, and hands that path to `ffprobe`
+  (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and
+  ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These
+  tools select a decoder from the file extension when the content does not
+  identify its own format, so an attacker who chooses the filename and declares
+  the content type of an upload chooses which decoder processes it. An FFmpeg
+  built with AviSynth support treats a file with the `.avs` extension as an
+  AviSynth script and evaluates it, which could disclose files readable by the
+  application process through the preview image, or load a native library the
+  attacker has also uploaded, possibly leading to remote code execution in the
+  FFmpeg process. ImageMagick selects its coders and delegates from the
+  extension in the same way.
+
+  ### Details
+
+  The fixed releases keep the uploaded extension on the tempfile only when
+  Marcel maps that extension to the blob's recorded content type, and name the
+  tempfile with no extension otherwise. A form upload whose Rack tempfile fails
+  the same check is copied to a correctly named tempfile before processing.
+  Files whose uploaded extension disagrees with their content type are still
+  processed; the external tool detects their format from the content. The Active
+  Storage CHANGELOG describes the change.
+
+  ### Affected applications
+
+  An application is affected if it meets all of these requirements:
+  - Accepts uploads from untrusted users.
+  - Analyzes video or audio attachments (which Active Storage does on attach by
+    default), generates video previews, or processes images with ImageMagick.
+
+  The AviSynth attack additionally requires an FFmpeg built with
+  `--enable-avisynth` and the AviSynthPlus runtime on the host. Upstream FFmpeg
+  and the common Linux distribution and Homebrew packages do not enable it; the
+  GPL builds distributed for Windows and Linux from ffmpeg.org do. Other
+  decoders that FFmpeg or ImageMagick select from the extension may be reachable
+  without AviSynth.
+
+  ### Mitigation
+
+  - Upgrade to a fixed version of `activestorage`.
+
+  ### Expire and change secrets
+
+  Upgrading closes the vulnerability but does not undo a disclosure that already
+  occurred. An application that meets the AviSynth requirement above should
+  treat every secret readable by the application process as potentially exposed
+  and change it, including `secret_key_base`, the master key and everything in
+  `config/credentials.yml.enc` that it decrypts, the Active Storage service
+  credentials, database credentials, and tokens for third-party services.
+  Changing `secret_key_base` expires active sessions and invalidates signed and
+  encrypted cookies, signed global IDs and Active Storage URLs. Do not retain an
+  exposed secret as a fallback.
+
+  ### Workarounds
+
+  Applications that cannot upgrade can stop Active Storage from running FFmpeg
+  on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from
+  `config.active_storage.previewers`, and
+  `ActiveStorage::Analyzer::VideoAnalyzer` and
+  `ActiveStorage::Analyzer::AudioAnalyzer` from
+  `config.active_storage.analyzers`. Running an FFmpeg built without AviSynth
+  support closes the AviSynth attack but not the extension-selected decoders of
+  ImageMagick.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636.patch
+
+  ### Versions affected
+
+  - activestorage < 8.0.5.2
+  - activestorage >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [pirikara](https://hackerone.com/pirikara).
+cvss_v3: 8.8
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e
+    - https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636
+    - https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml b/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml
new file mode 100644
index 0000000000..3c52033811
--- /dev/null
+++ b/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml
@@ -0,0 +1,65 @@
+---
+gem: activesupport
+framework: rails
+ghsa: 2w9f-fxwj-w2qf
+url: https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf
+title: "Possible XSS vulnerability in Active Support MessagePack serializer"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its
+  bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no
+  longer `html_safe?` (for example, one mutated in place with `gsub!`) is
+  restored as `html_safe`. If such a buffer holds untrusted input and is stored
+  through a MessagePack serializer, rendering it after it is loaded bypasses ERB
+  auto-escaping, possibly leading to XSS.
+
+  Applications on Rails 8.1 are affected if they use a MessagePack serializer,
+  such as `config.action_dispatch.cookies_serializer = :message_pack` or
+  `:message_pack_allow_marshal`, or `serializer: :message_pack` for
+  `Rails.cache`, `ActiveSupport::MessageVerifier` or
+  `ActiveSupport::MessageEncryptor`, and store a `SafeBuffer` that was mutated
+  in place with untrusted input. Rails 8.0 and earlier do not serialize
+  `SafeBuffer` with MessagePack and are not affected.
+
+  ### Details
+
+  The fixed releases serialize a `SafeBuffer` that is not `html_safe?` with a
+  marker and deserialize it as a `String`; a `SafeBuffer` that is `html_safe?`
+  keeps the existing format. Versions without the fix cannot read an unsafe
+  buffer serialized by the fixed releases, so during a rolling deploy a cookie
+  or cache entry holding one could fail to load on a process that has not been
+  upgraded.
+
+  ### Workarounds
+
+  Applications that cannot upgrade can convert a `SafeBuffer` to a `String` with
+  `to_str` before storing it in a value that a MessagePack serializer writes.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [jcwilk](https://hackerone.com/jcwilk).
+cvss_v3: 4.7
+unaffected_versions:
+  - "< 8.1.0"
+patched_versions:
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activesupport/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7
+    - https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA
diff --git a/gems/activesupport/GHSA-8474-xrp6-wh69.yml b/gems/activesupport/GHSA-8474-xrp6-wh69.yml
new file mode 100644
index 0000000000..4170d0fd5e
--- /dev/null
+++ b/gems/activesupport/GHSA-8474-xrp6-wh69.yml
@@ -0,0 +1,88 @@
+---
+gem: activesupport
+framework: rails
+ghsa: 8474-xrp6-wh69
+url: https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69
+title: "Possible DoS vulnerability in Active Support safe_constantize"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  When constant lookup raises `LoadError`,
+  `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`)
+  builds a regular expression from the requested constant name without escaping
+  it, so a caller that passes untrusted input lets the attacker choose the
+  source of a pattern that the application compiles. Crafted patterns can
+  trigger defects in Ruby's regular expression compiler, possibly leading to a
+  crash of the server process, and repeated requests could keep the application
+  unavailable.
+
+  Action Cable passes the `channel` value of each `subscribe` command to
+  `safe_constantize` before any channel lookup, so in the default configuration
+  an unauthenticated client of the Action Cable endpoint can reach this code.
+
+  ### Details
+
+  The check that decides whether `safe_constantize` returns `nil` or re-raises
+  the `LoadError` now matches the first segment of the constant name against the
+  error message as a literal string, and no longer compiles a regular
+  expression. It returns the same result as before for constant names that
+  contain no regular expression syntax.
+
+  ### Affected applications
+
+  An application is affected if it meets all of these requirements:
+  - Mounts Action Cable, which a new Rails application does by default at
+    `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted
+    input to `safe_constantize`.
+  - Accepts Action Cable connections from untrusted clients.
+    `ApplicationCable::Connection#connect` authenticates nobody unless the
+    application adds a check.
+
+  ### Workarounds
+
+  Applications that do not use Action Cable can set
+  `config.action_cable.mount_path = nil` to remove the endpoint. Applications
+  that use Action Cable can call `reject_unauthorized_connection` in
+  `ApplicationCable::Connection#connect` for unauthenticated clients, which
+  limits exposure to authenticated users but does not remove it.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch
+
+  ### Versions affected
+
+  - activesupport < 8.0.5.2
+  - activesupport >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by Felix Tscheulin
+  ([flixt](https://hackerone.com/flixt)) through HackerOne researcher
+  [scheja](https://hackerone.com/scheja), and independently by Bucky Wolfe
+  ([Igneous](https://github.com/Igneous)), who provided a proof of concept that
+  crashes the server. It was also found by the Anthropic OSS Scanner
+  (ANT-2026-ZUN5KU3Q).
+cvss_v3: 7.5
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/activesupport/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activesupport/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb
+    - https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20
+    - https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA