RA
Vendor
rails
36
CVEs
4
On KEV
0
New 30D
Products
RO7.5
Ruby on Rails
Rails
3 CVEs3 on KEV0 new
HT7.5
https://github.com/rails/rails
Rails
1 CVEs1 on KEV0 new
RA9.8
rails
rails
9 CVEs0 on KEV0 new
AC9.8
activestorage
rails
6 CVEs0 on KEV0 new
RA6.1
rails-html-sanitizer
rails
6 CVEs0 on KEV0 new
AC7.5
activesupport
rails
5 CVEs0 on KEV0 new
AP4.0
Action Pack
Rails
1 CVEs0 on KEV0 new
AC6.1
actionpack
rails
1 CVEs0 on KEV0 new
AC2.3
actionview
rails
1 CVEs0 on KEV0 new
KJ5.3
Kredis JSON
Rails
1 CVEs0 on KEV0 new
RA5.3
Rack
Rails
1 CVEs0 on KEV0 new
RA6.3
rails-ujs
Rails
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73648 | RA rails-html-sanitizer rails | 5.1 | Aug 13 | rails-html-sanitizer: Possible XSS vulnerability with certain configurations |
| CVE-2026-66066 | RA rails rails | 9.5 | Jul 30 | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing |
| CVE-2026-33658 | AC activestorage rails | 6.5 | Mar 26 | Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
| CVE-2026-33202 | AC activestorage rails | 9.1 | Mar 23 | Rails Active Storage has possible glob injection in its DiskService |
| CVE-2026-33195 | AC activestorage rails | 9.8 | Mar 23 | Rails Active Storage has possible Path Traversal in DiskService |
| CVE-2026-33176 | AC activesupport rails | 7.5 | Mar 23 | Rails Active Support has a possible DoS vulnerability in its number helpers |
| CVE-2026-33174 | AC activestorage rails | 7.5 | Mar 23 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
| CVE-2026-33173 | AC activestorage rails | 5.3 | Mar 23 | Rails Active Storage has possible content type bypass via metadata in direct uploads |
| CVE-2026-33170 | AC activesupport rails | 6.1 | Mar 23 | Rails Active Support has a possible XSS vulnerability in SafeBuffer#% |
| CVE-2026-33169 | AC activesupport rails | 5.3 | Mar 23 | Rails Active Support has a possible ReDoS vulnerability in number_to_delimited |
| CVE-2026-33168 | AC actionview rails | 2.3 | Mar 23 | Rails has a possible XSS vulnerability in its Action View tag helpers |
| CVE-2026-33167 | AC actionpack rails | 6.1 | Mar 23 | Rails has a possible XSS vulnerability in its Action Pack debug exceptions |
| CVE-2025-24293 | AC activestorage Rails | 8.1 | Jan 30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters… |
| CVE-2025-55193 | RA rails rails | 2.7 | Aug 13 | Active Record logging vulnerable to ANSI escape injection |
| CVE-2023-23913 | RA rails-ujs Rails | 6.3 | Jan 9 | There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute |
| CVE-2023-27531 | KJ Kredis JSON Rails | 5.3 | Jan 9 | There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code |
| CVE-2023-27539 | RA Rack Rails | 5.3 | Jan 9 | There is a denial of service vulnerability in the header parsing component of Rack |
| CVE-2023-28362 | AP Action Pack Rails | 4.0 | Jan 9 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value |
| CVE-2023-38037 | AC ActiveSupport Rails | 5.5 | Jan 9 | ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file |
| CVE-2023-28120 | AC ActiveSupport Rails | 5.3 | Jan 9 | There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input |
| CVE-2024-54133 | RA rails rails | 2.3 | Dec 10 | Possible Content Security Policy bypass in Action Dispatch |
| CVE-2024-53985 | RA rails-html-sanitizer rails | 6.1 | Dec 2 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 |
| CVE-2024-53987 | RA rails-html-sanitizer rails | 6.1 | Dec 2 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 |
| CVE-2024-53986 | RA rails-html-sanitizer rails | 6.1 | Dec 2 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 |
| CVE-2024-53988 | RA rails-html-sanitizer rails | 6.1 | Dec 2 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 |
| CVE-2024-53989 | RA rails-html-sanitizer rails | 6.1 | Dec 2 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 |
| CVE-2024-47889 | RA rails rails | 6.6 | Oct 16 | Action Mailer has possible ReDoS vulnerability in block_format |
| CVE-2024-47888 | RA rails rails | 6.6 | Oct 16 | Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node |
| CVE-2024-47887 | RA rails rails | 6.6 | Oct 16 | Action Controller has possible ReDoS vulnerability in HTTP Token authentication |
| CVE-2024-41128 | RA rails rails | 6.6 | Oct 16 | Action Dispatch has possible ReDoS vulnerability in query parameter filtering |
| CVE-2024-32464 | RA rails rails | 6.1 | Jun 4 | ActionText ContentAttachment can Contain Unsanitized HTML |
| CVE-2024-28103 | RA rails rails | 9.8 | Jun 4 | Action Pack is missing security headers on non-HTML responses |
| CVE-2019-5418 In wildKEV | HT https://github.com/rails/rails Rails | 7.5 | Mar 27 | Rails Ruby on Rails Path Traversal Vulnerability |
| CVE-2016-0752 In wildKEV | RO Ruby on Rails Rails | 7.5 | Feb 16 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows… |
| CVE-2014-0130 In wildKEV | RO Ruby on Rails Rails | 7.5 | May 7 | Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x… |