Rubyonrails Rails
121 CVEs affecting Rubyonrails Rails. Latest disclosed: 2026-03-26. Critical: 4, High: 25.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33195 | Critical | 9.8 | 2026-03-24 | Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskServi… |
CVE-2020-8165 | Critical | 9.8 | 2020-06-19 | A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects i… |
CVE-2019-5420 | Critical | 9.8 | 2019-03-27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development m… |
CVE-2026-33202 | Critical | 9.1 | 2026-03-24 | Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskServi… |
CVE-2020-8163 | High | 8.8 | 2020-07-02 | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call t… |
CVE-2017-17917 | High | 8.1 | 2017-12-29 | SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' par… |
CVE-2017-17916 | High | 8.1 | 2017-12-29 | SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name'… |
CVE-2022-23634 | High | 8.0 | 2022-02-11 | Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to… |
CVE-2026-33176 | High | 7.5 | 2026-03-24 | Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1… |
CVE-2026-33174 | High | 7.5 | 2026-03-24 | Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through… |
CVE-2024-26142 | High | 7.5 | 2024-02-27 | Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispat… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2021-22904 | High | 7.5 | 2021-06-11 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Ac… |
CVE-2021-22902 | High | 7.5 | 2021-06-11 | The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vu… |
CVE-2021-22885 | High | 7.5 | 2021-05-27 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper w… |
CVE-2021-22880 | High | 7.5 | 2021-02-11 | The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully c… |
CVE-2020-8164 | High | 7.5 | 2020-06-19 | A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadverte… |
CVE-2020-8162 | High | 7.5 | 2020-06-19 | A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Conten… |
CVE-2019-5419 | High | 7.5 | 2019-03-27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can c… |