Rails vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20194
3. 20202
4. 20225
5. 202415
6. 20257
7. 202613

Known exploitedNewest addition to KEV first

• CVE-2019-5418

  There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause…

  Rails · https://github.com/rails/rails

  ExploitedHigh7.5

Newest CVEs

• CVE-2026-73648

  rails-html-sanitizer: Possible XSS vulnerability with certain configurations

  rails · rails-html-sanitizer

  Medium5.1
• CVE-2026-66066

  Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

  rails · rails

  Critical9.5
• CVE-2026-33658

  Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

  rails · activestorage

  Low2.3
• CVE-2026-33202

  Rails Active Storage has possible glob injection in its DiskService

  rails · activestorage

  Medium6.6
• CVE-2026-33195

  Rails Active Storage has possible Path Traversal in DiskService

  rails · activestorage

  High8.0
• CVE-2026-33176

  Rails Active Support has a possible DoS vulnerability in its number helpers

  rails · activesupport

  Medium6.6
• CVE-2026-33174

  Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

  rails · activestorage

  Medium6.6
• CVE-2026-33173

  Rails Active Storage has possible content type bypass via metadata in direct uploads

  rails · activestorage

  Medium5.3
• CVE-2026-33170

  Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

  rails · activesupport

  Medium5.3
• CVE-2026-33169

  Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

  rails · activesupport

  Medium6.9