RU
Vendor
Rubyonrails
193
CVEs
3
On KEV
0
New 30D
Products
RA9.8
Rails
Rubyonrails
118 CVEs3 on KEV0 new
RO9.8
Ruby ON Rails
Rubyonrails
49 CVEs0 on KEV0 new
RH7.5
Rails Html Sanitizers
Rubyonrails
10 CVEs0 on KEV0 new
HS6.1
Html Sanitizer
Rubyonrails
4 CVEs0 on KEV0 new
AC6.1
Actionpack
Rubyonrails
2 CVEs0 on KEV0 new
AP9.8
Actionpack Page-caching
Rubyonrails
2 CVEs0 on KEV0 new
AC4.8
Actionview
Rubyonrails
1 CVEs0 on KEV0 new
AR5.3
Active Record Session Store
Rubyonrails
1 CVEs0 on KEV0 new
AR7.5
Active Resource
Rubyonrails
1 CVEs0 on KEV0 new
AS9.8
Active Storage
Rubyonrails
1 CVEs0 on KEV0 new
GL7.5
Globalid
Rubyonrails
1 CVEs0 on KEV0 new
JQ–
Jquery-rails
Rubyonrails
1 CVEs0 on KEV0 new
JQ–
Jquery-ujs
Rubyonrails
1 CVEs0 on KEV0 new
WC–
Web Console
Rubyonrails
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-33658 | RA Rails Rubyonrails | 6.5 | Mar 26 | Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
| CVE-2026-33202 | RA Rails Rubyonrails | 9.1 | Mar 23 | Rails Active Storage has possible glob injection in its DiskService |
| CVE-2026-33195 | RA Rails Rubyonrails | 9.8 | Mar 23 | Rails Active Storage has possible Path Traversal in DiskService |
| CVE-2026-33176 | RA Rails Rubyonrails | 7.5 | Mar 23 | Rails Active Support has a possible DoS vulnerability in its number helpers |
| CVE-2026-33174 | RA Rails Rubyonrails | 7.5 | Mar 23 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
| CVE-2026-33173 | RA Rails Rubyonrails | 5.3 | Mar 23 | Rails Active Storage has possible content type bypass via metadata in direct uploads |
| CVE-2026-33170 | RA Rails Rubyonrails | 6.1 | Mar 23 | Rails Active Support has a possible XSS vulnerability in SafeBuffer#% |
| CVE-2026-33169 | RA Rails Rubyonrails | 5.3 | Mar 23 | Rails Active Support has a possible ReDoS vulnerability in number_to_delimited |
| CVE-2026-33167 | RA Rails Rubyonrails | 6.1 | Mar 23 | Rails has a possible XSS vulnerability in its Action Pack debug exceptions |
| CVE-2024-53988 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 2 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2024-53987 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 2 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2024-53986 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 2 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2024-53985 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 2 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2024-53989 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 2 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2024-32464 | RA Rails Rubyonrails | 6.1 | Jun 4 | Action Text brings rich text content and editing to Rails |
| CVE-2024-28103 | RA Rails Rubyonrails | 9.8 | Jun 4 | Action Pack is a framework for handling and responding to web requests |
| CVE-2024-26144 | RA Rails Rubyonrails | 5.3 | Feb 27 | Rails is a web-application framework |
| CVE-2024-26143 | RA Rails Rubyonrails | 6.1 | Feb 27 | Rails is a web-application framework |
| CVE-2024-26142 | RA Rails Rubyonrails | 7.5 | Feb 27 | Rails is a web-application framework |
| CVE-2023-22799 | GL Globalid Rubyonrails | 7.5 | Feb 9 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an… |
| CVE-2023-22797 | RA Rails Rubyonrails | 6.1 | Feb 9 | An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input |
| CVE-2023-22795 | RA Rails Rubyonrails | 7.5 | Feb 9 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header |
| CVE-2023-22792 | RA Rails Rubyonrails | 7.5 | Feb 9 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1 |
| CVE-2022-23520 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2022-23519 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2022-23518 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Dec 14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2022-23517 | RH Rails Html Sanitizers Rubyonrails | 7.5 | Dec 14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications |
| CVE-2022-3704 | RA Rails Rubyonrails | 5.4 | Oct 26 | Ruby on Rails _table.html.erb cross site scripting |
| CVE-2022-32209 | RH Rails Html Sanitizers Rubyonrails | 6.1 | Jun 24 | # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been… |
| CVE-2022-27777 | AC Actionpack Rubyonrails | 6.1 | May 26 | A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes |
| CVE-2022-22577 | AC Actionpack Rubyonrails | 6.1 | May 26 | An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses |
| CVE-2022-21831 | AS Active Storage Rubyonrails | 9.8 | May 26 | A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments |
| CVE-2022-23634 | RA Rails Rubyonrails | 5.9 | Feb 11 | Puma is a Ruby/Rack web server built for parallelism |
| CVE-2022-23633 | RA Rails Rubyonrails | 5.9 | Feb 11 | Action Pack is a framework for handling and responding to web requests |
| CVE-2021-44528 | RA Rails Rubyonrails | 6.1 | Jan 10 | A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats… |
| CVE-2011-1497 | RA Rails Rubyonrails | 6.1 | Oct 19 | A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6 |
| CVE-2021-22942 | RA Rails Rubyonrails | 6.1 | Oct 18 | A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website |
| CVE-2021-22904 | RA Rails Rubyonrails | 7.5 | Jun 11 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due… |
| CVE-2021-22903 | RA Rails Rubyonrails | 6.1 | Jun 11 | The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability |
| CVE-2021-22902 | RA Rails Rubyonrails | 7.5 | Jun 11 | The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the… |
| CVE-2021-22885 | RA Rails Rubyonrails | 7.5 | May 27 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user… |
| CVE-2019-25025 | AR Active Record Session Store Rubyonrails | 5.3 | Mar 5 | The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about… |
| CVE-2021-22881 | RA Rails Rubyonrails | 6.1 | Feb 11 | The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability |
| CVE-2021-22880 | RA Rails Rubyonrails | 7.5 | Feb 11 | The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability |
| CVE-2020-8264 | RA Rails Rubyonrails | 6.1 | Jan 6 | In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a… |
| CVE-2020-8185 | RA Rails Rubyonrails | 6.5 | Jul 2 | A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production |
| CVE-2020-8166 | RA Rails Rubyonrails | 4.3 | Jul 2 | A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the… |
| CVE-2020-8163 | RA Rails Rubyonrails | 8.8 | Jul 2 | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE |
| CVE-2020-8167 | RA Rails Rubyonrails | 6.5 | Jun 19 | A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains |
| CVE-2020-8165 | RA Rails Rubyonrails | 9.8 | Jun 19 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and… |
| CVE-2020-8164 | RA Rails Rubyonrails | 7.5 | Jun 19 | A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked… |
| CVE-2020-8162 | RA Rails Rubyonrails | 7.5 | Jun 19 | A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct… |
| CVE-2020-8159 | AP Actionpack Page-caching Rubyonrails | 9.8 | May 12 | There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution… |
| CVE-2020-8151 | AR Active Resource Rubyonrails | 7.5 | May 12 | There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way… |
| CVE-2020-5267 | AC Actionview Rubyonrails | 4.8 | Mar 19 | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers |
| CVE-2010-3299 | RA Rails Rubyonrails | 6.5 | Nov 12 | The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks |
| CVE-2019-5420 | RA Rails Rubyonrails | 9.8 | Mar 27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token |
| CVE-2019-5419 | RA Rails Rubyonrails | 7.5 | Mar 27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to… |
| CVE-2019-5418 In wildKEV | RA Rails Rubyonrails | 7.5 | Mar 27 | Rails Ruby on Rails Path Traversal Vulnerability |
| CVE-2018-16477 | RA Rails Rubyonrails | 6.5 | Nov 30 | A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters… |