R
Vendor security profile3 actively exploited CVEs
rails
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical1
CISA KEV3
Public exploit4
Patch rate%71
Avg. CVSS7.1
12-month vulnerability rate
0
0
0
0
2
0
0
0
1
1
0
0
CVE KEV
CVE severity distribution
7toplam CVE
Critical1 (14%)
High1 (14%)
Medium3 (43%)
Uncertain2 (29%)
Patch and exploitation view
%71
Verified patch
%43
CISA KEV
%57
Public exploit
4Patch available
1Partial
2Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
7.4
CVE-2026-70658
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
P
Patch status unknownEPSS %1
5.1
CVE-2026-73648
rails-html-sanitizer: Possible XSS vulnerability with certain configurations
R
Patch verifiedEPSS %1
9.5
CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
R
Patch verifiedEPSS %28
9.6
CVE-2026-45758
Vulnerability in Guardrailsai Guardrails AI
G
Patch status unknownEPSS %0
8.0
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
R
Patch verifiedEPSS %1
6.1
CVE-2026-33167
Cross-site scripting in Rubyonrails
R
Patch verifiedEPSS %0
-
CVE-2019-5418 Actively exploited
Rails Ruby on Rails Path Traversal Vulnerability
R
WorkaroundEPSS %99
-
CVE-2014-0130 Actively exploited
Ruby on Rails Directory Traversal Vulnerability
R
WorkaroundEPSS %54
6.8
CVE-2016-0752 Actively exploited
rubygem-actionpack: directory traversal flaw in Action View
RH
Partial patchEPSS %96