Skip to contentRubyonrails Rails vulnerabilities
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsCVE-2026-33658Fix available2.3 Low
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has possible glob injection in its DiskServiceCVE-2026-33202Fix available6.6 Medium
- rubyonrails rails, rails activestorage, red hat 3scale api management platform 2 +2 moreRails Active Storage has possible Path Traversal in DiskServiceCVE-2026-33195Fix available8.0 High
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible DoS vulnerability in its number helpersCVE-2026-33176Fix available6.6 Medium
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsCVE-2026-33174Fix available6.6 Medium
- rubyonrails rails, rails activestorage +1 moreRails Active Storage has possible content type bypass via metadata in direct uploadsCVE-2026-33173Fix available5.3 Medium
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible XSS vulnerability in SafeBuffer#%CVE-2026-33170Fix available5.3 Medium
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible ReDoS vulnerability in number_to_delimitedCVE-2026-33169Fix available6.9 Medium
- rubyonrails rails, rails actionpack +1 moreRails has a possible XSS vulnerability in its Action Pack debug exceptionsCVE-2026-33167Fix available1.3 Low
- rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 morePossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0CVE-2024-53985Fix available2.3 Low
- rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 morePossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0CVE-2024-53987Fix available2.3 Low
- rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 morePossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0CVE-2024-53986Fix available2.3 Low
- rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 morePossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0CVE-2024-53988Fix available2.3 Low
- rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 morePossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0CVE-2024-53989Fix available2.3 Low
- railsAction Mailer has possible ReDoS vulnerability in block_formatCVE-2024-47889Fix available6.6 Medium
- railsAction Controller has possible ReDoS vulnerability in HTTP Token authenticationCVE-2024-47887Fix available6.6 Medium
- railsActionText ContentAttachment can Contain Unsanitized HTMLCVE-2024-32464Fix available6.1 Medium
- railsAction Pack is missing security headers on non-HTML responsesCVE-2024-28103Fix available5.4 Medium
- railsPossible Sensitive Session Information Leak in Active StorageCVE-2024-26144Public exploitFix available5.3 Medium
- railsRails Possible XSS Vulnerability in Action ControllerCVE-2024-26143Fix available6.1 Medium
- railsRails possible ReDoS vulnerability in Accept header parsing in Action DispatchCVE-2024-26142Fix available7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreReDoS based DoS vulnerability in Action DispatchCVE-2023-22792Fix available7.5 High
- rubyonrails rails, actionpack project actionpack, rails https://github.com/rails/rails +2 moreOpen Redirect Vulnerability in Action PackCVE-2023-22797Fix available6.1 Medium
- debian linux, rails https://github.com/rails/rails, rubyonrails rails +2 moreReDoS based DoS vulnerability in Action DispatchCVE-2023-22795Fix available7.5 High
- rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 morerails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityCVE-2022-23520Fix available6.1 Medium
- rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 morePossible XSS vulnerability with certain configurations of rails-html-sanitizerCVE-2022-23519Fix available7.2 High
- loofah project loofah, rails rails-html-sanitizer, debian linux +1 more +3 moreImproper neutralization of data URIs allows XSS in rails-html-sanitizerCVE-2022-23518Fix available6.1 Medium
- rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 moreInefficient Regular Expression Complexity in rails-html-sanitizerCVE-2022-23517Fix available7.5 High
- rubyonrails rails, unspecified ruby on rails +1 moreRuby on Rails _table.html.erb cross site scriptingCVE-2022-3704Disputed3.5 Low
- debian linux, fedoraproject fedora, rubyonrails rails html sanitizers +2 moreRails::Html::Sanitizer vulnerable to Cross-site ScriptingCVE-2022-32209Fix availableEPSS 26.5%6.1 Medium
- puma, rubyonrails rails, debian linux +1 more +3 moreInformation Exposure when using Puma with RailsCVE-2022-23634Fix available8.0 High
- rails, debian linux +1 moreExposure of sensitive information in Action PackCVE-2022-23633Fix available7.4 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreactionpack Open Redirect in Host Authorization MiddlewareCVE-2021-44528Fix available6.1 Medium
- railsCross site scripting in actionpack RubygemCVE-2011-1497Fix available6.1 Medium
- rails https://github.com/rails/rails, rubyonrails rails +1 moreOpen Redirect in ActionPackCVE-2021-22942Fix available6.1 Medium
- rails https://github.com/rails/rails, rubyonrails rails +1 morePossible DoS Vulnerability in Action Controller Token AuthenticationCVE-2021-22904Fix available7.5 High
- debian linux, rails https://github.com/rails/rails, rubyonrails actionpack page-caching +1 more +3 moreAction Pack contains Information Disclosure / Unintended Method Execution vulnerabilityCVE-2021-22885Fix available7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 morePossible Open Redirect Vulnerability in Action PackCVE-2021-22903Fix available6.1 Medium
- rubyonrails rails, rails https://github.com/rails/rails +1 moreDenial of Service in Action DispatchCVE-2021-22902Fix available7.5 High
- fedoraproject fedora, rails https://github.com/rails/rails, rubyonrails rails +2 moreActionpack Open Redirect VulnerabilityCVE-2021-22881Fix availableEPSS 87.3%6.1 Medium
- rubyonrails rails, fedoraproject fedora, rails https://github.com/rails/rails +2 moreActive Record subject to Regular Expression Denial-of-Service (ReDoS)CVE-2021-22880Public exploitFix available7.5 High
- rails https://github.com/rails/rails, rubyonrails rails +1 moreCross-site scripting in actionpackCVE-2020-8264Fix availableEPSS 67.0%6.1 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreRemote code execution via user-provided local names in ActionViewCVE-2020-8163Public exploitFix availableEPSS 82.5%8.8 High
- rubyonrails rails, fedoraproject fedora, rails https://github.com/rails/rails +2 moreUntrusted users can run pending migrations in production in RailsCVE-2020-8185Fix available6.5 Medium
- rubyonrails rails, debian linux +1 moreCSRF Vulnerability in rails-ujsCVE-2020-8167Fix available6.5 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreAbility to forge per-form CSRF tokens in RailsCVE-2020-8166Fix available4.3 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreCircumvention of file size limits in ActiveStorageCVE-2020-8162Public exploitFix available7.5 High
- rubyonrails rails, debian linux, opensuse backports sle +2 more +4 morePossible Strong Parameters Bypass in ActionPackCVE-2020-8164Fix available7.5 High
- rubyonrails rails, debian linux, opensuse leap +1 more +3 moreActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStoreCVE-2020-8165Public exploitFix availableEPSS 45.7%9.8 Critical
- rails, debian linux +1 moreThe encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.CVE-2010-32996.5 Medium
- Show olderLoading…