Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters…

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Action Text brings rich text content and editing to Rails

Rails is a web-application framework

An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats…

A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6

A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website

The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a…

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject…

Puma is a Ruby/Rack web server built for parallelism

Action Pack is a framework for handling and responding to web requests

Ruby on Rails _table.html.erb cross site scripting

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Rails is a web-application framework

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an…

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which…

activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and…

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the…