Rubyonrails vulnerabilities

Products

• Rails 120
• Ruby On Rails 49
• Rails Html Sanitizers 10
• Html Sanitizer 4
• Actionpack 2
• Actionpack Page-caching 2

Newest

• rubyonrails active storage The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing... CVE-2026-122006 Public exploit 9.8 CriticalNovember 4, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests CVE-2026-33658 Fix available 2.3 LowMarch 25, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has possible glob injection in its DiskService CVE-2026-33202 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage, red hat 3scale api management platform 2 +2 more Rails Active Storage has possible Path Traversal in DiskService CVE-2026-33195 Fix available 8.0 HighMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible DoS vulnerability in its number helpers CVE-2026-33176 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests CVE-2026-33174 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has possible content type bypass via metadata in direct uploads CVE-2026-33173 Fix available 5.3 MediumMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible XSS vulnerability in SafeBuffer#% CVE-2026-33170 Fix available 5.3 MediumMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible ReDoS vulnerability in number_to_delimited CVE-2026-33169 Fix available 6.9 MediumMarch 23, 2026
• rubyonrails rails, rails actionpack +1 more Rails has a possible XSS vulnerability in its Action Pack debug exceptions CVE-2026-33167 Fix available 1.3 LowMarch 23, 2026
• rubyonrails thor Withdrawn Advisory: Thor can construct an unsafe shell command from library input. CVE-2025-54314 Fix availableDisputed 2.8 LowJuly 20, 2025
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53985 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53987 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53986 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53988 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53989 Fix available 2.3 LowDecember 2, 2024
• rails Action Mailer has possible ReDoS vulnerability in block_format CVE-2024-47889 Fix available 6.6 MediumOctober 15, 2024
• rails Action Controller has possible ReDoS vulnerability in HTTP Token authentication CVE-2024-47887 Fix available 6.6 MediumOctober 15, 2024
• rails ActionText ContentAttachment can Contain Unsanitized HTML CVE-2024-32464 Fix available 6.1 MediumJune 4, 2024
• rails Action Pack is missing security headers on non-HTML responses CVE-2024-28103 Fix available 5.4 MediumJune 4, 2024
• rails Possible Sensitive Session Information Leak in Active Storage CVE-2024-26144 Public exploitFix available 5.3 MediumFebruary 27, 2024
• rails Rails Possible XSS Vulnerability in Action Controller CVE-2024-26143 Fix available 6.1 MediumFebruary 27, 2024
• rails Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch CVE-2024-26142 Fix available 7.5 HighFebruary 27, 2024
• rails https://github.com/rails/rails, rubyonrails rails +1 more ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22792 Fix available 7.5 HighJanuary 18, 2023
• rubyonrails rails, actionpack project actionpack, rails https://github.com/rails/rails +2 more Open Redirect Vulnerability in Action Pack CVE-2023-22797 Fix available 6.1 MediumJanuary 18, 2023
• debian linux, rails https://github.com/rails/rails, rubyonrails rails +2 more ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22795 Fix available 7.5 HighJanuary 18, 2023
• rubyonrails globalid ReDoS based DoS vulnerability in GlobalID CVE-2023-22799 Fix available 7.5 HighJanuary 18, 2023
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more rails-html-sanitizer contains an incomplete fix for an XSS vulnerability CVE-2022-23520 Fix available 6.1 MediumDecember 13, 2022
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23519 Fix available 7.2 HighDecember 13, 2022
• loofah project loofah, rails rails-html-sanitizer, debian linux +1 more +3 more Improper neutralization of data URIs allows XSS in rails-html-sanitizer CVE-2022-23518 Fix available 6.1 MediumDecember 13, 2022
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more Inefficient Regular Expression Complexity in rails-html-sanitizer CVE-2022-23517 Fix available 7.5 HighDecember 13, 2022
• rubyonrails rails, unspecified ruby on rails +1 more Ruby on Rails _table.html.erb cross site scripting CVE-2022-3704 Disputed 3.5 LowOctober 26, 2022
• debian linux, fedoraproject fedora, rubyonrails rails html sanitizers +2 more Rails::Html::Sanitizer vulnerable to Cross-site Scripting CVE-2022-32209 Fix available EPSS 26.5% 6.1 MediumJune 24, 2022
• debian linux, rails https://github.com/rails/rails, rubyonrails actionpack +2 more XSS Vulnerability in Action View tag helpers CVE-2022-27777 Fix available 6.1 MediumApril 27, 2022
• debian linux, rails https://github.com/rails/rails, rubyonrails actionpack +2 more Cross-site Scripting Vulnerability in Action Pack CVE-2022-22577 Fix available 6.1 MediumApril 27, 2022
• rubyonrails active storage, debian linux, rails https://github.com/rails/rails +2 more Possible code injection vulnerability in Rails / Active Storage CVE-2022-21831 Public exploitFix available 9.8 CriticalMarch 8, 2022
• puma, rubyonrails rails, debian linux +1 more +3 more Information Exposure when using Puma with Rails CVE-2022-23634 Fix available 8.0 HighFebruary 11, 2022
• rails, debian linux +1 more Exposure of sensitive information in Action Pack CVE-2022-23633 Fix available 7.4 HighFebruary 11, 2022
• rails https://github.com/rails/rails, rubyonrails rails +1 more actionpack Open Redirect in Host Authorization Middleware CVE-2021-44528 Fix available 6.1 MediumDecember 14, 2021
• rails Cross site scripting in actionpack Rubygem CVE-2011-1497 Fix available 6.1 MediumOctober 19, 2021
• rails https://github.com/rails/rails, rubyonrails rails +1 more Open Redirect in ActionPack CVE-2021-22942 Fix available 6.1 MediumAugust 26, 2021
• rails https://github.com/rails/rails, rubyonrails rails +1 more Possible DoS Vulnerability in Action Controller Token Authentication CVE-2021-22904 Fix available 7.5 HighMay 5, 2021
• debian linux, rails https://github.com/rails/rails, rubyonrails actionpack page-caching +1 more +3 more Action Pack contains Information Disclosure / Unintended Method Execution vulnerability CVE-2021-22885 Fix available 7.5 HighMay 5, 2021
• rails https://github.com/rails/rails, rubyonrails rails +1 more Possible Open Redirect Vulnerability in Action Pack CVE-2021-22903 Fix available 6.1 MediumMay 5, 2021
• rubyonrails rails, rails https://github.com/rails/rails +1 more Denial of Service in Action Dispatch CVE-2021-22902 Fix available 7.5 HighMay 5, 2021
• rubyonrails active record session store Activerecord-session_store Vulnerable to Timing Attack CVE-2019-25025 Fix available 5.3 MediumMarch 5, 2021
• fedoraproject fedora, rails https://github.com/rails/rails, rubyonrails rails +2 more Actionpack Open Redirect Vulnerability CVE-2021-22881 Fix available EPSS 87.3% 6.1 MediumFebruary 11, 2021
• rubyonrails rails, fedoraproject fedora, rails https://github.com/rails/rails +2 more Active Record subject to Regular Expression Denial-of-Service (ReDoS) CVE-2021-22880 Public exploitFix available 7.5 HighFebruary 11, 2021
• rails https://github.com/rails/rails, rubyonrails rails +1 more Cross-site scripting in actionpack CVE-2020-8264 Fix available EPSS 67.0% 6.1 MediumJanuary 6, 2021
• rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 more Remote code execution via user-provided local names in ActionView CVE-2020-8163 Public exploitFix available EPSS 82.5% 8.8 HighJuly 2, 2020
• Show olderLoading…