CVE Tools
Track your stack

Rails

149 CVEs tracked. 3 of them are in CISA KEV.

This hub aggregates every CVE we track for Rails, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Rails CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Rails CVEs per month
MonthCVEs
2024-121
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-081
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-039
2026-040
2026-050
2026-060
2026-071
2026-080
2026-090
2026-100
2026-1121

Severity

How the 149 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical75%
  • High4229%
  • Medium8961%
  • Low96%

Latest CVEs

The 15 most recently published vulnerabilities affecting Rails.

  1. CVE-2026-126188Active Storage: Possible local file disclosure in Active Storage video previews and analysis3.7
  2. CVE-2026-126186Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing8.8
  3. CVE-2026-126085Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage5.3
  4. CVE-2026-126084Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache_control4.7
  5. CVE-2026-126083Action Pack: Possible IP spoofing in Action Dispatch RemoteIp7.4
  6. CVE-2026-126082Active Storage: Possible arbitrary file write and read in Active Storage image analysis9.8
  7. CVE-2026-126081Action Pack: Possible Strong Parameters bypass in Parameters#each_key7.5
  8. CVE-2026-126080Active Support: Possible DoS vulnerability in Active Support safe_constantize7.5
  9. CVE-2026-126079Action View: Possible XSS vulnerability in Action View text helpers6.1
  10. CVE-2026-126078Action View: Possible XSS vulnerability in Action View highlight helper6.1
  11. CVE-2026-126077Action Pack: Possible sensitive session information leak in Active Storage proxy mode6.8
  12. CVE-2026-126076Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore4.2
  13. CVE-2026-126075Active Support: Possible XSS vulnerability in Active Support MessagePack serializer4.7
  14. CVE-2026-126074Active Storage: Possible DoS vulnerability in Active Storage filename handling4.3
  15. CVE-2026-126073Action Pack: Possible cache poisoning in Action Pack content negotiation4.8

Product grouping is registry-driven, with AI assist and human review. How it works