What’s Vulnerable › Products
Ruby on Rails vulnerabilities
123 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your Ruby on Rails version is affected
Exploited Ruby on Rails vulnerabilities
- CVE-2019-5418 — Rails Ruby on Rails Path Traversal Vulnerability
- CVE-2016-0752 — Ruby on Rails Directory Traversal Vulnerability
- CVE-2014-0130 — Ruby on Rails Directory Traversal Vulnerability
Latest Ruby on Rails vulnerabilities
- CVE-2026-66066 — Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (CVSS 9.5)
- CVE-2026-33658 — Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (CVSS 6.5)
- CVE-2026-33202 — Rails Active Storage has possible glob injection in its DiskService (CVSS 9.1)
- CVE-2026-33195 — Rails Active Storage has possible Path Traversal in DiskService (CVSS 9.8)
- CVE-2026-33176 — Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 7.5)
- CVE-2026-33174 — Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (CVSS 7.5)
- CVE-2026-33173 — Rails Active Storage has possible content type bypass via metadata in direct uploads (CVSS 5.3)
- CVE-2026-33170 — Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (CVSS 6.1)
- CVE-2026-33169 — Rails Active Support has a possible ReDoS vulnerability in number_to_delimited (CVSS 5.3)
- CVE-2026-33167 — Rails has a possible XSS vulnerability in its Action Pack debug exceptions (CVSS 6.1)
- CVE-2025-55193 — Active Record logging vulnerable to ANSI escape injection (CVSS 2.7)
- CVE-2024-54133 — Possible Content Security Policy bypass in Action Dispatch (CVSS 2.3)
- CVE-2024-47889 — Action Mailer has possible ReDoS vulnerability in block_format (CVSS 6.6)
- CVE-2024-47887 — Action Controller has possible ReDoS vulnerability in HTTP Token authentication (CVSS 6.6)
- CVE-2024-32464 — ActionText ContentAttachment can Contain Unsanitized HTML (CVSS 6.1)
- CVE-2024-28103 — Action Pack is missing security headers on non-HTML responses (CVSS 9.8)
- CVE-2024-26144 — Possible Sensitive Session Information Leak in Active Storage (CVSS 5.3)
- CVE-2024-26143 — Rails Possible XSS Vulnerability in Action Controller (CVSS 6.1)
- CVE-2024-26142 — Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch (CVSS 7.5)
- CVE-2023-22797 — (CVSS 6.1)
- CVE-2023-22795 — ReDoS based DoS vulnerability in Action Dispatch (CVSS 7.5)
- CVE-2023-22792 — ReDoS based DoS vulnerability in Action Dispatch (CVSS 7.5)
- CVE-2022-3704 — Ruby on Rails _table.html.erb cross site scripting (CVSS 5.4)
- CVE-2022-23634 — Information Exposure when using Puma with Rails (CVSS 5.9)
- CVE-2022-23633 — Exposure of sensitive information in Action Pack (CVSS 5.9)