CVE Tools
Track your stack

Rails

26 CVEs tracked since 2022. Since Dec 2022, none of them reached CISA KEV.

Rails CVEs per month

Dec 2022 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Rails CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-1240
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-1260
2025-0160
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-03100
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-1011 or fewer
2026-113 or fewer

Products

The products that kept showing up in Rails's monthly top three, with their CVEs summed over those months.

  1. Rails-html-sanitizer92 months
  2. Activestorage51 month
  3. Activesupport52 months
  4. Action Pack11 month
  5. Actionpack11 month
  6. Rails11 month
  7. Rails-ujs11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Rails.

  1. CVE-2026-126188Active Storage: Possible local file disclosure in Active Storage video previews and analysis3.7
  2. CVE-2026-126186Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing8.8
  3. CVE-2026-126085Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage5.3
  4. CVE-2026-126084Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache_control4.7
  5. CVE-2026-126083Action Pack: Possible IP spoofing in Action Dispatch RemoteIp7.4
  6. CVE-2026-126082Active Storage: Possible arbitrary file write and read in Active Storage image analysis9.8
  7. CVE-2026-126081Action Pack: Possible Strong Parameters bypass in Parameters#each_key7.5
  8. CVE-2026-126080Active Support: Possible DoS vulnerability in Active Support safe_constantize7.5
  9. CVE-2026-126079Action View: Possible XSS vulnerability in Action View text helpers6.1
  10. CVE-2026-126078Action View: Possible XSS vulnerability in Action View highlight helper6.1
  11. CVE-2026-126077Action Pack: Possible sensitive session information leak in Active Storage proxy mode6.8
  12. CVE-2026-126076Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore4.2
  13. CVE-2026-126075Active Support: Possible XSS vulnerability in Active Support MessagePack serializer4.7
  14. CVE-2026-126074Active Storage: Possible DoS vulnerability in Active Storage filename handling4.3
  15. CVE-2026-126073Action Pack: Possible cache poisoning in Action Pack content negotiation4.8

The record

Peak rank
#113 in Dec 2024
Busiest month shown
Mar 2026, 10 CVEs
Months with a KEV entry
0 since Dec 2022
Monthly snapshots
4 since 2022
Rails's full record, month by month