Rails vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20193
3. 20191
4. 20202
5. 20225
6. 202415
7. 20252
8. 20256
9. 202612

Known exploitedNewest addition to KEV first

• CVE-2019-5418

  There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…

  Rails · https://github.com/rails/rails

  ExploitedHigh7.5

Newest CVEs

• CVE-2026-73648

  rails-html-sanitizer: Possible XSS vulnerability with certain configurations

  rails · rails-html-sanitizer

  Medium5.1
• CVE-2026-66066

  Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

  rails · rails

  Critical9.5
• CVE-2026-33658

  Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

  rails · activestorage

  Low2.3
• CVE-2026-33202

  Rails Active Storage has possible glob injection in its DiskService

  rails · activestorage

  Medium6.6
• CVE-2026-33195

  Rails Active Storage has possible Path Traversal in DiskService

  rails · activestorage

  High8.0
• CVE-2026-33176

  Rails Active Support has a possible DoS vulnerability in its number helpers

  rails · activesupport

  Medium6.6
• CVE-2026-33174

  Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

  rails · activestorage

  Medium6.6
• CVE-2026-33173

  Rails Active Storage has possible content type bypass via metadata in direct uploads

  rails · activestorage

  Medium5.3
• CVE-2026-33170

  Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

  rails · activesupport

  Medium5.3
• CVE-2026-33169

  Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

  rails · activesupport

  Medium6.9