Vendor
Rails
47 known vulnerabilities in products by Rails, 1 of them actively exploited (CISA KEV).
Key figures
47
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2019-5418 | Rails Ruby on Rails Path Traversal Vulnerability In CISA KEValso in 6 other products | 7.5 | |
| Critical | CVE-2026-66066 | Rails: Initialization of a Resource with an Insecure Default | — | |
| Critical | CVE-2025-24293 | Rails Activestorage: Command Injection | 8.1 | |
| Critical | CVE-2019-5420 | Rails Https://github.com/rails/rails: Command Injection | 9.8 | |
| High | CVE-2019-5419 | Rails Https://github.com/rails/rails: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2022-23633 | Exposure of sensitive information in Action Pack | 7.4 | |
| High | CVE-2024-26142 | Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch | 7.5 | |
| High | CVE-2022-23517 | Inefficient Regular Expression Complexity in rails-html-sanitizer | 7.5 | |
| Medium | CVE-2020-15169 | XSS in Action View | 5.4 | |
| Critical | CVE-2026-33202 | Rails Active Storage has possible glob injection in its DiskService | 9.1 | |
| Critical | CVE-2026-33195 | Rails Active Storage has possible Path Traversal in DiskService | 9.8 | |
| High | CVE-2026-33176 | Rails Active Support has a possible DoS vulnerability in its number helpers | 7.5 | |
| Medium | CVE-2024-41128 | Action Dispatch has possible ReDoS vulnerability in query parameter filtering | — | |
| High | CVE-2026-33174 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests | 7.5 | |
| Medium | CVE-2024-47887 | Action Controller has possible ReDoS vulnerability in HTTP Token authentication | — | |
| High | CVE-2022-23519 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer | 7.2 | |
| Medium | CVE-2026-33169 | Rails Active Support has a possible ReDoS vulnerability in number_to_delimited | 5.3 | |
| Medium | CVE-2024-47888 | Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node | — | |
| Medium | CVE-2024-26144 | Possible Sensitive Session Information Leak in Active Storage | 5.3 | |
| Medium | CVE-2024-47889 | Action Mailer has possible ReDoS vulnerability in block_format | — | |
| Medium | CVE-2022-23520 | rails-html-sanitizer contains an incomplete fix for an XSS vulnerability | 6.1 | |
| Medium | CVE-2018-3741 | Rails-html-sanitizer: Cross-site Scripting | 6.1 | |
| Medium | CVE-2010-3299 | Rails: security vulnerability | 6.5 | |
| Medium | CVE-2024-26143 | Rails Possible XSS Vulnerability in Action Controller | 6.1 | |
| Medium | CVE-2023-27539 | Rails Rack: Denial of Service | 5.3 |
News
Products
| Rails | 14 | 0 |
| Rails-html-sanitizer | 11 | 0 |
| Activestorage | 6 | 0 |
| Rails ActiveSupport | 5 | 0 |
| Actionview | 3 | 0 |
| Https://github.com/rails/rails | 3 | 1 |