How many CVEs does rails have?

rails has 143 published CVE records since 2006, including 19 in the last two years.

How many rails CVEs are in CISA KEV?

Yes — 2 of rails's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which rails products have the most CVEs?

The rails products with the most published CVEs are rails, actionpack, activerecord, rails-html-sanitizer, activesupport.

What are the most common weakness types in rails CVEs?

rails's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Are there public exploits for rails vulnerabilities?

Yes — 20 of rails's CVEs have a known public exploit.

How many critical rails vulnerabilities are there?

rails has 9 critical and 40 high-severity CVEs.

What is the average severity of rails CVEs?

The average CVSS base score across rails's scored CVEs is 6.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

143 CVEs

2 in CISA KEV

rails Vulnerabilities

Name: rails vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for rails.

143

Total CVEs

Published

2

In CISA KEV

Exploited in the wild

20

Public exploits

PoC or exploit code

6.1

Avg CVSS

2006–2026

Overview

rails has 143 published CVE records since 2006, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 20 have a known public exploit. The average CVSS base score across scored CVEs is 6.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting rails products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on rails's vulnerability posture, as a share of its 143 published CVEs.

Average CVSS: 6.1
Critical / high: 34%
Actively exploited (KEV): 1%
Public exploit available: 14%
Patch available: 98%

Severity and exploitation

How the CVSS severity of rails's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical9

High40

Medium83

Low11

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of rails's CVEs are confirmed exploited in the wild.

Public exploits

20

20 of rails's CVEs have a known public exploit available.

Most affected products

The rails products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in rails CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish rails CVE records.

Disclosure activity by year

How many rails CVEs were published each year.

2019

4

2020

11

2021

10

2022

13

2023

7

2024

15

2025

8

2026

11

Latest rails CVEs

The most recently disclosed vulnerabilities affecting rails.

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
CWE-770
Low · CVSS 2.3
EPSS 0.4%2026-03-26
Rails Active Storage has possible glob injection in its DiskService
CWE-74
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has possible Path Traversal in DiskService
CWE-22
High · CVSS 8.0
EPSS 0.6%2026-03-23
Rails Active Support has a possible DoS vulnerability in its number helpers
CWE-400
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
CWE-789
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has possible content type bypass via metadata in direct uploads
CWE-925
Medium · CVSS 5.3
EPSS 0.4%2026-03-23
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
CWE-79
Medium · CVSS 5.3
EPSS 0.3%2026-03-23
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
CWE-400
Medium · CVSS 6.9
EPSS 0.5%2026-03-23
Rails has a possible XSS vulnerability in its Action View tag helpers
CWE-79
Low · CVSS 2.3
EPSS 0.5%2026-03-23
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
CWE-79
Low · CVSS 1.3
EPSS 0.4%2026-03-23
Critical vulnerability · 2026-01-30
CWE-94
Critical · CVSS 9.2
EPSS 2.4%2026-01-30
Active Record logging vulnerable to ANSI escape injection
CWE-150
Medium · CVSS 5.3
EPSS 0.6%2025-08-13

Track new rails CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor rails CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Veritas144 CVEs Fuji Electric144 CVEs graalvm144 CVEs SICK144 CVEs AYS Pro143 CVEs StyleMix Themes143 CVEs axiomatic-systems142 CVEs Brainstorm Force142 CVEs

Browse all vendors

Frequently asked questions

Common questions about rails vulnerabilities.

How many CVEs does rails have?: rails has 143 published CVE records since 2006, including 19 in the last two years.
How many rails CVEs are in CISA KEV?: Yes — 2 of rails's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which rails products have the most CVEs?: The rails products with the most published CVEs are rails, actionpack, activerecord, rails-html-sanitizer, activesupport.
What are the most common weakness types in rails CVEs?: rails's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for rails vulnerabilities?: Yes — 20 of rails's CVEs have a known public exploit.
How many critical rails vulnerabilities are there?: rails has 9 critical and 40 high-severity CVEs.
What is the average severity of rails CVEs?: The average CVSS base score across rails's scored CVEs is 6.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track rails vulnerabilities

Monitor new rails vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing