RA
Vendor
rails
23
CVEs
4
On KEV
0
New 30D
Products
RO7.5
Ruby on Rails
Rails
3 CVEs3 on KEV0 new
HT7.5
https://github.com/rails/rails
Rails
1 CVEs1 on KEV0 new
AC9.8
activestorage
rails
6 CVEs0 on KEV0 new
AC7.5
activesupport
rails
5 CVEs0 on KEV0 new
AP4.0
Action Pack
Rails
1 CVEs0 on KEV0 new
AC6.1
actionpack
rails
1 CVEs0 on KEV0 new
AC2.3
actionview
rails
1 CVEs0 on KEV0 new
KJ5.3
Kredis JSON
Rails
1 CVEs0 on KEV0 new
RA5.3
Rack
Rails
1 CVEs0 on KEV0 new
RA9.5
rails
rails
1 CVEs0 on KEV0 new
RA5.1
rails-html-sanitizer
rails
1 CVEs0 on KEV0 new
RA6.3
rails-ujs
Rails
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73648 | RA rails-html-sanitizer rails | 5.1 | Aug 13 | rails-html-sanitizer: Possible XSS vulnerability with certain configurations |
| CVE-2026-66066 | RA rails rails | 9.5 | Jul 30 | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing |
| CVE-2026-33658 | AC activestorage rails | 6.5 | Mar 26 | Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
| CVE-2026-33202 | AC activestorage rails | 9.1 | Mar 23 | Rails Active Storage has possible glob injection in its DiskService |
| CVE-2026-33195 | AC activestorage rails | 9.8 | Mar 23 | Rails Active Storage has possible Path Traversal in DiskService |
| CVE-2026-33176 | AC activesupport rails | 7.5 | Mar 23 | Rails Active Support has a possible DoS vulnerability in its number helpers |
| CVE-2026-33174 | AC activestorage rails | 7.5 | Mar 23 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
| CVE-2026-33173 | AC activestorage rails | 5.3 | Mar 23 | Rails Active Storage has possible content type bypass via metadata in direct uploads |
| CVE-2026-33170 | AC activesupport rails | 6.1 | Mar 23 | Rails Active Support has a possible XSS vulnerability in SafeBuffer#% |
| CVE-2026-33169 | AC activesupport rails | 5.3 | Mar 23 | Rails Active Support has a possible ReDoS vulnerability in number_to_delimited |
| CVE-2026-33168 | AC actionview rails | 2.3 | Mar 23 | Rails has a possible XSS vulnerability in its Action View tag helpers |
| CVE-2026-33167 | AC actionpack rails | 6.1 | Mar 23 | Rails has a possible XSS vulnerability in its Action Pack debug exceptions |
| CVE-2025-24293 | AC activestorage Rails | 8.1 | Jan 30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters… |
| CVE-2023-23913 | RA rails-ujs Rails | 6.3 | Jan 9 | There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute |
| CVE-2023-27531 | KJ Kredis JSON Rails | 5.3 | Jan 9 | There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code |
| CVE-2023-27539 | RA Rack Rails | 5.3 | Jan 9 | There is a denial of service vulnerability in the header parsing component of Rack |
| CVE-2023-28362 | AP Action Pack Rails | 4.0 | Jan 9 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value |
| CVE-2023-38037 | AC ActiveSupport Rails | 5.5 | Jan 9 | ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file |
| CVE-2023-28120 | AC ActiveSupport Rails | 5.3 | Jan 9 | There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input |
| CVE-2019-5418 In wildKEV | HT https://github.com/rails/rails Rails | 7.5 | Mar 27 | Rails Ruby on Rails Path Traversal Vulnerability |
| CVE-2016-0752 In wildKEV | RO Ruby on Rails Rails | 7.5 | Feb 16 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows… |
| CVE-2014-0130 In wildKEV | RO Ruby on Rails Rails | 7.5 | May 7 | Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x… |