Ruby On Rails
87 CVEs tracked. 2 of them are in CISA KEV.
This hub aggregates every CVE we track for Ruby On Rails, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Ruby On Rails CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 6 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 87 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical6
- High30
- Medium49
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Ruby On Rails.
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests6.5
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskService9.1
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpers7.5
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests7.5
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%6.1
- CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimited5.3
- CVE-2024-26144Possible Sensitive Session Information Leak in Active Storage5.3
- CVE-2024-26143Rails Possible XSS Vulnerability in Action Controller6.1
- CVE-2023-22792A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can caus...7.5
- CVE-2023-22797An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully...6.1
- CVE-2023-22795A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expres...7.5
- CVE-2023-22794A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hint...8.8
- CVE-2022-3704Ruby on Rails _table.html.erb cross site scripting3.5
- CVE-2022-27777A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.6.1
- CVE-2022-21831A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.9.8
Product grouping is registry-driven, with AI assist and human review. How it works