added today's Rails vulnerability