How many Rails actionpack CVEs are in CISA KEV?

None of Rails actionpack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Rails actionpack are affected?

174 distinct Rails actionpack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Rails actionpack CVEs?

Rails actionpack's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-264 (Permissions, Privileges, and Access Controls), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).

How many critical Rails actionpack vulnerabilities are there?

Rails actionpack has 1 critical and 10 high-severity CVEs.

What is the average severity of Rails actionpack CVEs?

The average CVSS base score across Rails actionpack's scored CVEs is 5.7.

Rails actionpack Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Rails actionpack vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

Rails actionpack has 46 published CVE records since 2009, of which none are in CISA's KEV catalog and 14 have a known public exploit. The average CVSS base score across scored CVEs is 5.7.

Severity and exploitation

How the CVSS severity of Rails actionpack's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High10

Medium32

Low3

In CISA’s Known Exploited Vulnerabilities catalog

None of Rails actionpack's CVEs are currently listed in CISA's KEV catalog.

Public exploits

14 of Rails actionpack's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Rails actionpack version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges12 most-used of 90

3.0.0 <= v < 3.0.43 CVEs
4.0.0 <= v < 4.0.23 CVEs
7.0.0 <= v < 7.0.4.13 CVEs
< 2.3.162 CVEs
2.3.0 <= v < 2.3.132 CVEs
3.0.0 <= v < 3.0.102 CVEs
3.0.0 <= v < 3.2.162 CVEs
3.0.0 <= v < 3.2.172 CVEs
3.0.0 <= v < 3.2.22.22 CVEs

Common weakness types

The CWE weakness categories most often found in Rails actionpack CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Rails actionpack CVEs were published each year.

2016

2017

2018

2019

2020

2021

2022

Other Rails products

Browse vulnerabilities for other products by Rails.

rails110 CVEs activerecord15 CVEs rails-html-sanitizer15 CVEs ActiveSupport13 CVEs activestorage9 CVEs actionview8 CVEs https://github.com/rails/rails3 CVEs

Frequently asked questions

Common questions about Rails actionpack vulnerabilities.

How many CVEs does Rails actionpack have?: Rails actionpack has 46 published CVE records since 2009.
How many Rails actionpack CVEs are in CISA KEV?: None of Rails actionpack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Rails actionpack vulnerabilities?: Yes — 14 of Rails actionpack's CVEs have a known public exploit.
Which versions of Rails actionpack are affected?: 174 distinct Rails actionpack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Rails actionpack CVEs?: Rails actionpack's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-264 (Permissions, Privileges, and Access Controls), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).
How many critical Rails actionpack vulnerabilities are there?: Rails actionpack has 1 critical and 10 high-severity CVEs.
What is the average severity of Rails actionpack CVEs?: The average CVSS base score across Rails actionpack's scored CVEs is 5.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Rails actionpack vulnerabilities

Get an alert for each new Rails actionpack CVE, with AI-written analysis and remediation steps.

Create an account See pricing

Frequently asked questions

Common questions about Rails actionpack vulnerabilities.

How many CVEs does Rails actionpack have?: Rails actionpack has 46 published CVE records since 2009.
How many Rails actionpack CVEs are in CISA KEV?: None of Rails actionpack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Rails actionpack vulnerabilities?: Yes — 14 of Rails actionpack's CVEs have a known public exploit.
Which versions of Rails actionpack are affected?: 174 distinct Rails actionpack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Rails actionpack CVEs?: Rails actionpack's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-264 (Permissions, Privileges, and Access Controls), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).
How many critical Rails actionpack vulnerabilities are there?: Rails actionpack has 1 critical and 10 high-severity CVEs.
What is the average severity of Rails actionpack CVEs?: The average CVSS base score across Rails actionpack's scored CVEs is 5.7.

Find a version

Showing the 40 most-used of 174 versions. Search to find any version.

46 CVEs

Sort

Rails has a possible XSS vulnerability in its Action Pack debug exceptions
CVE-2026-33167
Patch
Workaround
CWE-79
Low · CVSS 1.3
EPSS 0.3% (18th pct)2026-03-23
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
CVE-2023-28362
Patch
CWE-116
Medium · CVSS 4.0
EPSS 0.3% (27th pct)2025-01-09
Possible Content Security Policy bypass in Action Dispatch
CVE-2024-54133
Patch
Workaround
CWE-79
Low · CVSS 2.3
EPSS 1.0% (63th pct)2024-12-10
Action Controller has possible ReDoS vulnerability in HTTP Token authentication
CVE-2024-47887
Patch
CWE-1333
Medium · CVSS 6.6
EPSS 1.0% (64th pct)2024-10-16
Action Dispatch has possible ReDoS vulnerability in query parameter filtering
CVE-2024-41128
Patch
CWE-770
Medium · CVSS 6.6
EPSS 1.1% (66th pct)2024-10-16
Action Pack is missing security headers on non-HTML responses
CVE-2024-28103
Patch
CWE-20
Critical · CVSS 9.8
EPSS 0.7% (52th pct)2024-06-04
Rails Possible XSS Vulnerability in Action Controller
CVE-2024-26143
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 1.0% (64th pct)2024-02-27
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
CVE-2024-26142
Public exploit
Patch
CWE-1333
High · CVSS 7.5
EPSS 1.5% (74th pct)2024-02-27
Open Redirect Vulnerability in Action Pack
CVE-2023-22797
Patch
CWE-601
Medium · CVSS 6.1
EPSS 0.6% (49th pct)2023-02-09
ReDoS based DoS vulnerability in Action Dispatch
CVE-2023-22795
Patch
CWE-400
High · CVSS 7.5
EPSS 2.3% (83th pct)2023-02-09
ReDoS based DoS vulnerability in Action Dispatch
CVE-2023-22792
Patch
CWE-400
High · CVSS 7.5
EPSS 1.7% (77th pct)2023-02-09
Cross-site Scripting Vulnerability in Action Pack
CVE-2022-22577
Patch
CWE-79
Medium · CVSS 6.1
EPSS 1.8% (79th pct)2022-05-26
Exposure of sensitive information in Action Pack
CVE-2022-23633
Patch
Workaround
CWE-200
High · CVSS 7.4
EPSS 2.2% (83th pct)2022-02-11
actionpack Open Redirect in Host Authorization Middleware
CVE-2021-44528
Patch
CWE-601
Medium · CVSS 6.1
EPSS 4.4% (91th pct)2022-01-07
Cross site scripting in actionpack Rubygem
CVE-2011-1497
Public exploit
Patch
CWE-79
Medium · CVSS 6.1
EPSS 1.3% (70th pct)2021-10-19
Open Redirect in ActionPack
CVE-2021-22942
Patch
CWE-601
Medium · CVSS 6.1
EPSS 1.7% (77th pct)2021-10-18
Possible DoS Vulnerability in Action Controller Token Authentication
CVE-2021-22904
Public exploit
Patch
CWE-400
High · CVSS 7.5
EPSS 4.9% (92th pct)2021-06-11
Actionpack Open Redirect Vulnerability
CVE-2021-22881
Public exploit
Patch
CWE-601
Medium · CVSS 6.1
EPSS 87.3% (100th pct)2021-02-11
Ability to forge per-form CSRF tokens in Rails
CVE-2020-8166
Public exploit
Patch
CWE-352
Medium · CVSS 4.3
EPSS 1.7% (77th pct)2020-07-02
Possible Strong Parameters Bypass in ActionPack
CVE-2020-8164
Public exploit
Patch
CWE-502
High · CVSS 7.5
EPSS 4.9% (92th pct)2020-06-19
actionpack allows remote code execution via application's unrestricted use of render method
CVE-2016-2098
Public exploit
Patch
CWE-20
High · CVSS 7.3
EPSS 81.4% (100th pct)2016-04-07
actionview contains Path Traversal vulnerability
CVE-2016-2097
Patch
CWE-22
Medium · CVSS 5.3
EPSS 4.4% (91th pct)2016-04-07
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
CVE-2016-0751
Patch
Workaround
CWE-399
High · CVSS 7.5
EPSS 9.7% (96th pct)2016-02-16
actionpack is vulnerable to remote bypass authentication
CVE-2015-7576
Patch
Workaround
CWE-254
Low · CVSS 3.7
EPSS 4.9% (92th pct)2016-02-16
actionpack Improper Input Validation vulnerability
CVE-2014-0082
Patch
CWE-20
Medium · CVSS 5.0
EPSS 6.2% (94th pct)2014-02-20
Rails vulnerable to Cross-site Scripting
CVE-2014-0081
Patch
CWE-79
Medium · CVSS 4.3
EPSS 4.0% (91th pct)2014-02-20
actionpack allows bypass of database-query restrictions
CVE-2013-6417
Patch
CWE-264
Medium · CVSS 6.4
EPSS 2.4% (84th pct)2013-12-07
actionpack Cross-site Scripting vulnerability
CVE-2013-6416
Patch
CWE-79
Medium · CVSS 4.3
EPSS 2.0% (80th pct)2013-12-07
actionpack Improper Input Validation vulnerability
CVE-2013-6414
Public exploit
Patch
CWE-20
Medium · CVSS 5.0
EPSS 20.7% (98th pct)2013-12-07
actionpack Cross-site Scripting vulnerability
CVE-2013-1857
Patch
CWE-79
Medium · CVSS 4.3
EPSS 1.9% (79th pct)2013-03-19

Showing 30 of 46

Rails actionpack Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges12 most-used of 90

Common weakness types

Disclosure activity by year

Other Rails products

Frequently asked questions

References

Track Rails actionpack vulnerabilities

Frequently asked questions

Affected versions and CVEs

Version ranges12 most-used of 90

Fixed in12 most-used of 84