RA
Product
Rails
On CISA KEVExploited in the wild
118
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 23Medium 27Low 1
Watch
Add Rails to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33195 | 9.8 | Mar 23 | Rails Active Storage has possible Path Traversal in DiskService Affected: before 7.2.3.1; 8.0.0 before 8.0.4.1; 8.1.0 before 8.1.2.1 |
| CVE-2024-28103 | 9.8 | Jun 4 | Action Pack is a framework for handling and responding to web requests Affected: 6.1.0 before 6.1.7.8; 7.0.0 before 7.0.8.4; 7.1.0 before 7.1.3.4; 7.2.0 |
| CVE-2020-8165 | 9.8 | Jun 19 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and… Affected: before 5.2.4.3; 6.0.0 before 6.0.3.1 |
| CVE-2019-5420 | 9.8 | Mar 27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token Affected: before 5.2.2.1; 6.0.0; 6.0.0 |
| CVE-2026-33202 | 9.1 | Mar 23 | Rails Active Storage has possible glob injection in its DiskService Affected: before 7.2.3.1; 8.0.0 before 8.0.4.1; 8.1.0 before 8.1.2.1 |
Showing 5