How many CVEs does rubyonrails have?

rubyonrails has 149 published CVE records since 2006, including 9 in the last two years.

How many rubyonrails CVEs are in CISA KEV?

Yes — 3 of rubyonrails's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which rubyonrails products have the most CVEs?

The rubyonrails products with the most published CVEs are rails, ruby_on_rails, rails html sanitizers, html sanitizer, actionpack.

What are the most common weakness types in rubyonrails CVEs?

rubyonrails's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

How many critical rubyonrails vulnerabilities are there?

rubyonrails has 7 critical and 44 high-severity CVEs.

What is the average severity of rubyonrails CVEs?

The average CVSS base score across rubyonrails's scored CVEs is 6.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

149 CVEs

3 in CISA KEV

rubyonrails Vulnerabilities

Name: rubyonrails vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for rubyonrails.

149

Total CVEs

Published

3

In CISA KEV

Exploited in the wild

19

Public exploits

PoC or exploit code

6.1

Avg CVSS

2006–2026

Overview

rubyonrails has 149 published CVE records since 2006, of which 3 are in CISA's Known Exploited Vulnerabilities catalog and 19 have a known public exploit. The average CVSS base score across scored CVEs is 6.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting rubyonrails products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on rubyonrails's vulnerability posture, as a share of its 149 published CVEs.

Average CVSS: 6.1
Critical / high: 34%
Actively exploited (KEV): 2%
Public exploit available: 13%
Patch available: 96%

Severity and exploitation

How the CVSS severity of rubyonrails's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High44

Medium90

Low8

In CISA’s Known Exploited Vulnerabilities catalog

3

3 of rubyonrails's CVEs are confirmed exploited in the wild.

Public exploits

19

19 of rubyonrails's CVEs have a known public exploit available.

Most affected products

The rubyonrails products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in rubyonrails CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish rubyonrails CVE records.

Disclosure activity by year

How many rubyonrails CVEs were published each year.

2019

4

2020

10

2021

10

2022

12

2023

5

2024

12

2025

1

2026

8

Latest rubyonrails CVEs

The most recently disclosed vulnerabilities affecting rubyonrails.

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
CWE-770
Low · CVSS 2.3
EPSS 0.4%2026-03-26
Rails Active Storage has possible glob injection in its DiskService
CWE-74
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has possible Path Traversal in DiskService
CWE-22
High · CVSS 8.0
EPSS 0.6%2026-03-23
Rails Active Support has a possible DoS vulnerability in its number helpers
CWE-400
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
CWE-789
Medium · CVSS 6.6
EPSS 0.6%2026-03-23
Rails Active Storage has possible content type bypass via metadata in direct uploads
CWE-925
Medium · CVSS 5.3
EPSS 0.4%2026-03-23
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
CWE-79
Medium · CVSS 5.3
EPSS 0.3%2026-03-23
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
CWE-400
Medium · CVSS 6.9
EPSS 0.5%2026-03-23
Low vulnerability · 2025-07-20
CWE-78
Low · CVSS 2.8
EPSS 0.2%2025-07-20
Low vulnerability · 2024-12-02
CWE-79
Low · CVSS 2.3
EPSS 0.6%2024-12-02
Low vulnerability · 2024-12-02
CWE-79
Low · CVSS 2.3
EPSS 0.4%2024-12-02
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
CWE-79
Low · CVSS 2.3
EPSS 0.5%2024-12-02

Track new rubyonrails CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor rubyonrails CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

chamilo151 CVEs mandrakesoft151 CVEs Prestashop151 CVEs MISP150 CVEs Quest149 CVEs craftcms148 CVEs Grafana148 CVEs Kaspersky148 CVEs

Browse all vendors

Frequently asked questions

Common questions about rubyonrails vulnerabilities.

How many CVEs does rubyonrails have?: rubyonrails has 149 published CVE records since 2006, including 9 in the last two years.
How many rubyonrails CVEs are in CISA KEV?: Yes — 3 of rubyonrails's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which rubyonrails products have the most CVEs?: The rubyonrails products with the most published CVEs are rails, ruby_on_rails, rails html sanitizers, html sanitizer, actionpack.
What are the most common weakness types in rubyonrails CVEs?: rubyonrails's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-400 (Uncontrolled Resource Consumption), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for rubyonrails vulnerabilities?: Yes — 19 of rubyonrails's CVEs have a known public exploit.
How many critical rubyonrails vulnerabilities are there?: rubyonrails has 7 critical and 44 high-severity CVEs.
What is the average severity of rubyonrails CVEs?: The average CVSS base score across rubyonrails's scored CVEs is 6.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track rubyonrails vulnerabilities

Monitor new rubyonrails vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing