All · Ruby on Rails

Newest first. Every filter here is also a feed: see the subscribe box.

1. 8.4high
   CVE-2026-81097rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape

   Ruby on Rails
   2 mo ago 2026-08-27
2. 9.5crit
   CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

   1 exploitEPSS 30.1% chance of exploitation in 30 days, percentile 98%EPSS 30.1%Ruby on Railsrubygems
   3 mo ago 2026-07-30
3. 5.1med
   CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurations

   Ruby on Railsrubygems
   3 mo ago 2026-07-21
4. 6.5med
   CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

   Ruby on Railsrubygems
   7 mo ago 2026-03-25
5. 9.1crit
   CVE-2026-33202Rails Active Storage has possible glob injection in its DiskService

   Ruby on Railsrubygems
   7 mo ago 2026-03-23
6. 8.1high
   CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskService

   Ruby on Railsrubygems
   7 mo ago 2026-03-23
7. 7.5high
   CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpers

   Ruby on Railsrubygems
   7 mo ago 2026-03-23
8. 7.5high
   CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

   Ruby on Railsrubygems
   7 mo ago 2026-03-23
9. 5.3med
   CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploads

   Ruby on Railsrubygems
   7 mo ago 2026-03-23
10. 6.1med
    CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

    Ruby on Railsrubygems
    7 mo ago 2026-03-23
11. 5.3med
    CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

    Ruby on Railsrubygems
    7 mo ago 2026-03-23
12. 2.3low
    CVE-2026-33168Rails has a possible XSS vulnerability in its Action View tag helpers

    Ruby on Railsrubygems
    7 mo ago 2026-03-23
13. 6.1med
    CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptions

    Ruby on Railsrubygems
    7 mo ago 2026-03-23
14. 8.1high
    CVE-2025-24293Active Storage allowed transformation methods that were potentially unsafe

    1 exploitEPSS 5.6% chance of exploitation in 30 days, percentile 93%EPSS 5.6%Ruby on Railsrubygems
    14 mo ago 2025-08-14
15. 2.7low
    CVE-2025-55193Active Record logging vulnerable to ANSI escape injection

    Ruby on Railsrubygems
    14 mo ago 2025-08-13
16. 2.3low
    CVE-2024-54133Possible Content Security Policy bypass in Action Dispatch

    EPSS 1.0% chance of exploitation in 30 days, percentile 63%EPSS 1.0%Ruby on Railsrubygems
    22 mo ago 2024-12-10
17. 6.1med
    CVE-2024-53985Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

    Ruby on Railsrubygems
    23 mo ago 2024-12-02
18. 6.1med
    CVE-2024-53987Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

    Ruby on Railsrubygems
    23 mo ago 2024-12-02
19. 6.1med
    CVE-2024-53986Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

    Ruby on Railsrubygems
    23 mo ago 2024-12-02
20. 6.1med
    CVE-2024-53988Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

    Ruby on Railsrubygems
    23 mo ago 2024-12-02
21. 6.1med
    CVE-2024-53989Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0

    Ruby on Railsrubygems
    23 mo ago 2024-12-02
22. 6.6med
    CVE-2024-47889Action Mailer has possible ReDoS vulnerability in block_format

    Ruby on Railsrubygems
    2 y ago 2024-10-15
23. 6.6med
    CVE-2024-47888Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

    Ruby on Railsrubygems
    2 y ago 2024-10-15
24. 6.6med
    CVE-2024-47887Action Controller has possible ReDoS vulnerability in HTTP Token authentication

    EPSS 1.0% chance of exploitation in 30 days, percentile 64%EPSS 1.0%Ruby on Railsrubygems
    2 y ago 2024-10-15
25. 6.6med
    CVE-2024-41128Action Dispatch has possible ReDoS vulnerability in query parameter filtering

    EPSS 1.1% chance of exploitation in 30 days, percentile 66%EPSS 1.1%Ruby on Railsrubygems
    2 y ago 2024-10-15
26. 6.1med
    CVE-2024-32464ActionText ContentAttachment can Contain Unsanitized HTML

    Ruby on Railsrubygems
    2 y ago 2024-06-04
27. 5.4med
    CVE-2024-28103Action Pack is missing security headers on non-HTML responses

    Ruby on Railsrubygems
    2 y ago 2024-06-04
28. 5.3med
    CVE-2024-26144Possible Sensitive Session Information Leak in Active Storage

    EPSS 1.3% chance of exploitation in 30 days, percentile 70%EPSS 1.3%Ruby on Railsrubygems
    2 y ago 2024-02-27
29. 6.1med
    CVE-2024-26143Rails Possible XSS Vulnerability in Action Controller

    EPSS 1.0% chance of exploitation in 30 days, percentile 64%EPSS 1.0%Ruby on Railsrubygems
    2 y ago 2024-02-27
30. 7.5high
    CVE-2024-26142Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch

    EPSS 1.5% chance of exploitation in 30 days, percentile 74%EPSS 1.5%Ruby on Railsrubygems
    2 y ago 2024-02-27