Actionpack
64 CVEs tracked. 2 of them are in CISA KEV.
This hub aggregates every CVE we track for Actionpack, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Actionpack CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 2 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 64 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High15
- Medium45
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Actionpack.
- CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptions6.1
- CVE-2023-28362The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC com...4.0
- CVE-2024-54133Possible Content Security Policy bypass in Action Dispatch4.3
- CVE-2024-47887Action Controller has possible ReDoS vulnerability in HTTP Token authentication3.7
- CVE-2024-41128Action Dispatch has possible ReDoS vulnerability in query parameter filtering3.7
- CVE-2024-28103Action Pack is missing security headers on non-HTML responses5.4
- CVE-2024-26143Rails Possible XSS Vulnerability in Action Controller6.1
- CVE-2024-26142Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch7.5
- CVE-2023-22792A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can caus...7.5
- CVE-2023-22797An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully...6.1
- CVE-2023-22795A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expres...7.5
- CVE-2022-3704Ruby on Rails _table.html.erb cross site scripting3.5
- CVE-2022-27777A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.6.1
- CVE-2022-22577An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.6.1
- CVE-2022-23633Exposure of sensitive information in Action Pack7.4
Product grouping is registry-driven, with AI assist and human review. How it works