RRails

Products

Exploited and recent CVEs

• CVE-2019-5418 High 7.5 Exploited There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targe 98.5%
• CVE-2026-73648 Medium 5.1 rails-html-sanitizer: Possible XSS vulnerability with certain configurations 0.5%
• CVE-2026-66066 Critical 9.5 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing 30.1%
• CVE-2026-33658 Low 2.3 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests 0.5%
• CVE-2026-33202 Medium 6.6 Rails Active Storage has possible glob injection in its DiskService 0.7%
• CVE-2026-33195 High 8.1 Rails Active Storage has possible Path Traversal in DiskService 0.6%
• CVE-2026-33176 Medium 6.6 Rails Active Support has a possible DoS vulnerability in its number helpers 0.9%
• CVE-2026-33174 Medium 6.6 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests 0.6%
• CVE-2026-33173 Medium 5.3 Rails Active Storage has possible content type bypass via metadata in direct uploads 0.4%
• CVE-2026-33170 Medium 5.3 Rails Active Support has a possible XSS vulnerability in SafeBuffer#% 0.3%
• CVE-2026-33169 Medium 6.9 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited 0.7%
• CVE-2026-33168 Low 2.3 Rails has a possible XSS vulnerability in its Action View tag helpers 0.7%
• CVE-2026-33167 Low 1.3 Rails has a possible XSS vulnerability in its Action Pack debug exceptions 0.3%
• CVE-2025-24293 High 8.1 # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The d 5.6%
• CVE-2025-55193 Low 2.7 Active Record logging vulnerable to ANSI escape injection 0.6%
• CVE-2023-23913 Medium 6.3 There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential 0.6%
• CVE-2023-27531 Medium 5.3 There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code 0.5%
• CVE-2023-27539 Medium 5.3 There is a denial of service vulnerability in the header parsing component of Rack. 1.1%
• CVE-2023-28362 Medium 4.0 The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compli 0.3%
• CVE-2023-38037 Medium 5.5 ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's pos 0.3%
• CVE-2023-28120 Medium 5.3 There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. 0.9%
• CVE-2024-54133 Low 2.3 Possible Content Security Policy bypass in Action Dispatch 1.0%
• CVE-2024-53985 Low 2.3 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 0.6%
• CVE-2024-53987 Low 2.3 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 0.4%
• CVE-2024-53986 Low 2.3 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 0.5%
• CVE-2024-53988 Low 2.3 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 0.4%
• CVE-2024-53989 Low 2.3 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 0.5%
• CVE-2024-47889 Medium 6.6 Action Mailer has possible ReDoS vulnerability in block_format 0.9%
• CVE-2024-47888 Medium 6.6 Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node 1.0%
• CVE-2024-47887 Medium 6.6 Action Controller has possible ReDoS vulnerability in HTTP Token authentication 1.0%