Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,161All CVEsplus 18,875 rejected
- 813Last 24 hours3,232 in the last 7 days
- 17,421Last 30 days1,567 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 1 | 7 | 3 | 0 | 13 | 47 |
| 2025 | 0 | 0 | 6 | 1 | 0 | 7 | 34 |
| 2024 | 0 | 1 | 8 | 6 | 0 | 15 | 27 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 12 |
| 2022 | 0 | 3 | 2 | 0 | 0 | 5 | 12 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 7 |
| 2020 | 0 | 0 | 2 | 0 | 0 | 2 | 7 |
| 2019 | 1 | 2 | 1 | 0 | 0 | 4 | 5 |
| 2018 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-73648 | rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails · rails-html-sanitizer | Medium5.1 |
| CVE-2026-66066 | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · rails | Critical9.5 |
| CVE-2026-33658 | Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsrails · activestorage | Low2.3 |
| CVE-2026-33202 | Rails Active Storage has possible glob injection in its DiskServicerails · activestorage | Medium6.6 |
| CVE-2026-33195 | Rails Active Storage has possible Path Traversal in DiskServicerails · activestorage | High8.0 |
| CVE-2026-33176 | Rails Active Support has a possible DoS vulnerability in its number helpersrails · activesupport | Medium6.6 |
| CVE-2026-33174 | Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requestsrails · activestorage | Medium6.6 |
| CVE-2026-33173 | Rails Active Storage has possible content type bypass via metadata in direct uploadsrails · activestorage | Medium5.3 |
| CVE-2026-33170 | Rails Active Support has a possible XSS vulnerability in SafeBuffer#%rails · activesupport | Medium5.3 |
| CVE-2026-33169 | Rails Active Support has a possible ReDoS vulnerability in number_to_delimitedrails · activesupport | Medium6.9 |
| CVE-2026-33168 | Rails has a possible XSS vulnerability in its Action View tag helpersrails · actionview | Low2.3 |
| CVE-2026-33167 | Rails has a possible XSS vulnerability in its Action Pack debug exceptionsrails · actionpack | Low1.3 |
| CVE-2025-24293 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation…Rails · activestorage | Critical9.2 |
| CVE-2025-55193 | Active Record logging vulnerable to ANSI escape injectionrails · rails | Low2.7 |
| CVE-2023-23913 | There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the…Rails · rails-ujs | Medium6.3 |
| CVE-2023-27531 | There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeRails · Kredis JSON | Medium5.3 |
| CVE-2023-27539 | There is a denial of service vulnerability in the header parsing component of Rack.Rails · Rack | Medium5.3 |
| CVE-2023-28362 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for…Rails · Action Pack | Medium4.0 |
| CVE-2023-38037 | ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current…Rails · ActiveSupport | Medium5.5 |
| CVE-2023-28120 | There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.Rails · ActiveSupport | Medium5.3 |
| CVE-2024-54133 | Possible Content Security Policy bypass in Action Dispatchrails · rails | Low2.3 |
| CVE-2024-53985 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails · rails-html-sanitizer | Low2.3 |
| CVE-2024-53987 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails · rails-html-sanitizer | Low2.3 |
| CVE-2024-53986 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails · rails-html-sanitizer | Low2.3 |
| CVE-2024-53988 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails · rails-html-sanitizer | Low2.3 |
| CVE-2024-53989 | Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails · rails-html-sanitizer | Low2.3 |
| CVE-2024-47889 | Action Mailer has possible ReDoS vulnerability in block_formatrails · rails | Medium6.6 |
| CVE-2024-47888 | Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_noderails · rails | Medium6.6 |
| CVE-2024-47887 | Action Controller has possible ReDoS vulnerability in HTTP Token authenticationrails · rails | Medium6.6 |
| CVE-2024-41128 | Action Dispatch has possible ReDoS vulnerability in query parameter filteringrails · rails | Medium6.6 |
| CVE-2024-32464 | ActionText ContentAttachment can Contain Unsanitized HTMLrails · rails | Medium6.1 |
| CVE-2024-28103 | Action Pack is missing security headers on non-HTML responsesrails · rails | Medium5.4 |
| CVE-2024-26144 | Possible Sensitive Session Information Leak in Active Storagerails · rails | Medium5.3 |
| CVE-2024-26143 | Rails Possible XSS Vulnerability in Action Controllerrails · rails | Medium6.1 |
| CVE-2024-26142 | Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatchrails · rails | High7.5 |
| CVE-2022-23520 | rails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityrails · rails-html-sanitizer | Medium6.1 |
| CVE-2022-23519 | Possible XSS vulnerability with certain configurations of rails-html-sanitizerrails · rails-html-sanitizer | High7.2 |
| CVE-2022-23518 | Improper neutralization of data URIs allows XSS in rails-html-sanitizerrails · rails-html-sanitizer | Medium6.1 |
| CVE-2022-23517 | Inefficient Regular Expression Complexity in rails-html-sanitizerrails · rails-html-sanitizer | High7.5 |
| CVE-2022-23633 | Exposure of sensitive information in Action Packrails · rails | High7.4 |
| CVE-2020-15169 | XSS in Action Viewrails · actionview | Medium5.4 |
| CVE-2020-5267 | Possible XSS vulnerability in ActionViewrails · actionview | Medium4.0 |
| CVE-2010-3299 | The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.rails · rails | Medium6.5 |
| CVE-2019-5420 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development…Rails · https://github.com/rails/rails | Critical9.8 |
| CVE-2019-5419 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can…Rails · https://github.com/rails/rails | High7.5 |
| CVE-2019-5418 | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…ExploitedRails · https://github.com/rails/rails | High7.5 |
| CVE-2018-3741 | There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in…Rails · rails-html-sanitizer | Medium6.1 |