# actionpack (RubyGems) vulnerabilities 62 known vulnerabilities (5 high, 7 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/actionpack ## Advisories (62) ### [CVE-2026-33167](https://cve.now/CVE-2026-33167): Rails has a possible XSS vulnerability in its Action Pack debug exceptions - Severity: Low 1.3 - Published: Mar 23, 2026 - Affected: from 8.1.0, fixed in 8.1.2.1. ### [CVE-2023-28362](https://cve.now/CVE-2023-28362): The redirect\_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. - Severity: Medium 4.0 - Published: Jan 9, 2025 - Affected: fixed in 6.1.7.4; from 7.0.0, fixed in 7.0.5.1. ### [CVE-2024-54133](https://cve.now/CVE-2024-54133): Possible Content Security Policy bypass in Action Dispatch - Severity: Low 2.3 - Published: Dec 10, 2024 - Affected: from 5.2.0, fixed in 7.0.8.7; from 7.1.0, fixed in 7.1.5.1; from 7.2.0, fixed in 7.2.2.1; from 8.0.0, fixed in 8.0.0.1. ### [CVE-2024-47887](https://cve.now/CVE-2024-47887): Action Controller has possible ReDoS vulnerability in HTTP Token authentication - Severity: Medium 6.6 - Published: Oct 16, 2024 - Affected: from 4.0.0, fixed in 6.1.7.9; from 7.0.0, fixed in 7.0.8.5; from 7.1.0, fixed in 7.1.4.1; from 7.2.0, fixed in 7.2.1.1. ### [CVE-2024-41128](https://cve.now/CVE-2024-41128): Action Dispatch has possible ReDoS vulnerability in query parameter filtering - Severity: Medium 6.6 - Published: Oct 16, 2024 - Affected: from 3.1.0, fixed in 6.1.7.9; from 7.0.0, fixed in 7.0.8.5; from 7.1.0, fixed in 7.1.4.1; from 7.2.0, fixed in 7.2.1.1. ### [CVE-2024-28103](https://cve.now/CVE-2024-28103): Action Pack is missing security headers on non-HTML responses - Severity: Medium 5.4 - Published: Jun 4, 2024 - Affected: from 6.1.0, fixed in 6.1.7.8; from 7.0.0, fixed in 7.0.8.4; from 7.1.0, fixed in 7.1.3.4; from 7.2.0.beta1, fixed in 7.2.0.beta2. ### [CVE-2024-26143](https://cve.now/CVE-2024-26143): Rails Possible XSS Vulnerability in Action Controller - Severity: Medium 6.1 - Published: Feb 27, 2024 - Affected: from 7.0.0, fixed in 7.0.8.1; from 7.1.0, fixed in 7.1.3.1. ### [CVE-2024-26142](https://cve.now/CVE-2024-26142): Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch - Severity: High 7.5 - Published: Feb 27, 2024 - Affected: from 7.1.0, fixed in 7.1.3.1. ### [CVE-2023-22797](https://cve.now/CVE-2023-22797): An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect\_to with… - Severity: Medium 6.1 - Published: Feb 9, 2023 - Affected: from 7.0.0, fixed in 7.0.4.1. ### [CVE-2023-22795](https://cve.now/CVE-2023-22795): A regular expression based DoS vulnerability in Action Dispatch \<6.1.7.1 and \<7.0.4.1 related to the If-None-Match header. - Severity: Unrated - Published: Feb 9, 2023 - Affected: from 4.0.0.beta1, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1. ### [CVE-2023-22792](https://cve.now/CVE-2023-22792): A regular expression based DoS vulnerability in Action Dispatch \<6.0.6.1,\< 6.1.7.1, and \<7.0.4.1. - Severity: High 7.5 - Published: Feb 9, 2023 - Affected: from 3.0.0, fixed in 5.2.8.15; from 6.0.0, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1. ### [CVE-2022-22577](https://cve.now/CVE-2022-22577): An XSS Vulnerability in Action Pack \>= 5.2.0 and \< 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses. - Severity: Unrated - Published: May 26, 2022 - Affected: from 5.2.0, fixed in 5.2.7.1; from 6.0.0, fixed in 6.0.4.8; from 6.1.0, fixed in 6.1.5.1; from 7.0.0, fixed in 7.0.2.4. ### [CVE-2022-23633](https://cve.now/CVE-2022-23633): Exposure of sensitive information in Action Pack - Severity: High 7.4 - Published: Feb 11, 2022 - Affected: from 5.0.0.0, fixed in 5.2.6.2; from 6.0.0.0, fixed in 6.0.4.6; from 6.1.0.0, fixed in 6.1.4.6; from 7.0.0.0, fixed in 7.0.2.2. ### [CVE-2021-44528](https://cve.now/CVE-2021-44528): A open redirect vulnerability exists in Action Pack \>= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in… - Severity: Unrated - Published: Jan 7, 2022 - Affected: from 6.0.0, fixed in 6.0.4.2; from 6.1.0, fixed in 6.1.4.2. ### [CVE-2011-1497](https://cve.now/CVE-2011-1497): A cross-site scripting vulnerability flaw was found in the auto\_link function in Rails before version 3.0.6. - Severity: Unrated - Published: Oct 19, 2021 - Affected: from 3.0.0.rc, fixed in 3.0.6. ### [CVE-2021-22942](https://cve.now/CVE-2021-22942): A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \>= 6.0.0 that could allow attackers to redirect… - Severity: Unrated - Published: Oct 18, 2021 - Affected: from 6.0.0, fixed in 6.0.4.1; from 6.1.0, fixed in 6.1.4.1. ### [CVE-2021-22904](https://cve.now/CVE-2021-22904): The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token… - Severity: Unrated - Published: Jun 11, 2021 - Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2; from 5.2.5, fixed in 5.2.6; from 4.0.0, fixed in 5.2.4.6. ### [CVE-2021-22903](https://cve.now/CVE-2021-22903): The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. - Severity: Unrated - Published: Jun 11, 2021 - Affected: from 6.1.0.rc2, fixed in 6.1.3.2. ### [CVE-2021-22902](https://cve.now/CVE-2021-22902): The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible… - Severity: Unrated - Published: Jun 11, 2021 - Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2. ### [CVE-2021-22885](https://cve.now/CVE-2021-22885): A possible information disclosure / unintended method execution vulnerability in Action Pack \>= 2.0.0 when using the \`redirect\_to\` or… - Severity: Unrated - Published: May 27, 2021 - Affected: from 6.0.0, fixed in 6.0.3.7; from 6.1.0, fixed in 6.1.3.2; from 5.2.5, fixed in 5.2.6; from 2.0.0, fixed in 5.2.4.6. ### [CVE-2021-22881](https://cve.now/CVE-2021-22881): The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. - Severity: Unrated - Published: Feb 11, 2021 - Affected: from 6.0.0, fixed in 6.0.3.5; from 6.1.0, fixed in 6.1.2.1. ### [CVE-2020-8264](https://cve.now/CVE-2020-8264): In actionpack gem \>= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to… - Severity: Unrated - Published: Jan 6, 2021 - Affected: from 6.0.0, fixed in 6.0.3.4. ### [CVE-2020-8166](https://cve.now/CVE-2020-8166): A CSRF forgery vulnerability exists in rails \< 5.2.5, rails \< 6.0.4 that makes it possible for an attacker to, given a global CSRF token… - Severity: Medium 4.3 - Published: Jul 2, 2020 - Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1. ### [CVE-2020-8185](https://cve.now/CVE-2020-8185): A denial of service vulnerability exists in Rails \<6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app… - Severity: Unrated - Published: Jul 2, 2020 - Affected: from 6.0.0, fixed in 6.0.3.2. ### [CVE-2020-8164](https://cve.now/CVE-2020-8164): A deserialization of untrusted data vulnerability exists in rails \< 5.2.4.3, rails \< 6.0.3.1 which can allow an attacker to supply… - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1. ### [CVE-2016-2098](https://cve.now/CVE-2016-2098): Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary… - Severity: Unrated - Published: Apr 7, 2016 - Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2; from 4.2.0, fixed in 4.2.5.2. ### [CVE-2016-2097](https://cve.now/CVE-2016-2097): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read… - Severity: Unrated - Published: Apr 7, 2016 - Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2. ### [CVE-2016-0752](https://cve.now/CVE-2016-0752): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an - Severity: High 7.5 · KEV - Published: Feb 16, 2016 - Affected: from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1; fixed in 3.2.22.1. ### [CVE-2016-0751](https://cve.now/CVE-2016-0751): actionpack/lib/action\_dispatch/http/mime\_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x… - Severity: Unrated - Published: Feb 16, 2016 - Affected: from 4.2.0, fixed in 4.2.5.1; fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1. ### [CVE-2015-7581](https://cve.now/CVE-2015-7581): actionpack/lib/action\_dispatch/routing/route\_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows… - Severity: Unrated - Published: Feb 16, 2016 - Affected: from 4.0.0, fixed in 4.2.5.1. ### [CVE-2015-7576](https://cve.now/CVE-2015-7576): The http\_basic\_authenticate\_with method in actionpack/lib/action\_controller/metal/http\_authentication.rb in the Basic Authentication… - Severity: Unrated - Published: Feb 16, 2016 - Affected: from 3.1.0, fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1. ### [CVE-2014-7829](https://cve.now/CVE-2014-7829): Directory traversal vulnerability in actionpack/lib/action\_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before… - Severity: Unrated - Published: Nov 18, 2014 - Affected: from 4.1.0, fixed in 4.1.8; from 3.0.0, fixed in 3.2.21; from 4.0.0, fixed in 4.0.12; from 4.2.0.beta1, fixed in 4.2.0.beta4. ### [CVE-2014-7818](https://cve.now/CVE-2014-7818): Directory traversal vulnerability in actionpack/lib/action\_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before… - Severity: Unrated - Published: Nov 8, 2014 - Affected: from 3.0.0, fixed in 3.2.20; from 4.0.0, fixed in 4.0.11; from 4.1.0, fixed in 4.1.7; from 4.2.0.beta1, fixed in 4.2.0.beta3. ### [CVE-2014-0130](https://cve.now/CVE-2014-0130): Directory traversal vulnerability in actionpack/lib/abstract\_controller/base.rb in the implicit-render implementation in Ruby on Rails befor - Severity: High 7.5 · KEV - Published: May 7, 2014 - Affected: from 3.0.0, fixed in 3.2.18; from 4.0.0, fixed in 4.0.5; from 4.1.0, fixed in 4.1.1. ### [CVE-2014-0082](https://cve.now/CVE-2014-0082): actionpack/lib/action\_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during… - Severity: Unrated - Published: Feb 20, 2014 - Affected: from 3.0.0, fixed in 3.2.17. ### [CVE-2014-0081](https://cve.now/CVE-2014-0081): Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action\_view/helpers/number\_helper.rb in Ruby on Rails before 3.2.17… - Severity: Unrated - Published: Feb 20, 2014 - Affected: from 3.0.0, fixed in 3.2.17; from 4.0.0, fixed in 4.0.3. ### [CVE-2013-6417](https://cve.now/CVE-2013-6417): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences… - Severity: Unrated - Published: Dec 7, 2013 - Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2. ### [CVE-2013-6416](https://cve.now/CVE-2013-6416): Cross-site scripting (XSS) vulnerability in the simple\_format helper in actionpack/lib/action\_view/helpers/text\_helper.rb in Ruby on Rails… - Severity: Unrated - Published: Dec 7, 2013 - Affected: from 4.0.0, fixed in 4.0.2. ### [CVE-2013-6415](https://cve.now/CVE-2013-6415): Cross-site scripting (XSS) vulnerability in the number\_to\_currency helper in actionpack/lib/action\_view/helpers/number\_helper.rb in Ruby… - Severity: Unrated - Published: Dec 7, 2013 - Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2. ### [CVE-2013-6414](https://cve.now/CVE-2013-6414): actionpack/lib/action\_view/lookup\_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote… - Severity: Unrated - Published: Dec 7, 2013 - Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2. ### [CVE-2013-4491](https://cve.now/CVE-2013-4491): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/translation\_helper.rb in the internationalization component… - Severity: Unrated - Published: Dec 7, 2013 - Affected: from 3.0.0, fixed in 3.2.16; from 4.0.0, fixed in 4.0.2. ### [CVE-2013-1857](https://cve.now/CVE-2013-1857): The sanitize helper in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before… - Severity: Unrated - Published: Mar 19, 2013 - Affected: fixed in 2.3.18; from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13. ### [CVE-2013-1855](https://cve.now/CVE-2013-1855): The sanitize\_css method in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails… - Severity: Unrated - Published: Mar 19, 2013 - Affected: fixed in 2.3.18; from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13. ### [CVE-2013-0156](https://cve.now/CVE-2013-0156): active\_support/core\_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before… - Severity: Unrated - Published: Jan 13, 2013 - Affected: fixed in 2.3.15; from 3.0.0, fixed in 3.0.19; from 3.1.0, fixed in 3.1.10; from 3.2.0, fixed in 3.2.11. ### [CVE-2012-3465](https://cve.now/CVE-2012-3465): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/sanitize\_helper.rb in the strip\_tags helper in Ruby on… - Severity: Unrated - Published: Aug 10, 2012 - Affected: from 3.0.0.beta, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8; fixed in 2.3.16. ### [CVE-2012-3463](https://cve.now/CVE-2012-3463): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/form\_tag\_helper.rb in Ruby on Rails 3.x before 3.0.17… - Severity: Unrated - Published: Aug 10, 2012 - Affected: from 3.0, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8. ### [CVE-2012-3424](https://cve.now/CVE-2012-3424): The decode\_credentials method in actionpack/lib/action\_controller/metal/http\_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x… - Severity: Unrated - Published: Aug 8, 2012 - Affected: from 3.0.0.beta, fixed in 3.0.16; from 3.1.0, fixed in 3.1.7; from 3.2.0, fixed in 3.2.7; fixed in 2.3.5. ### [CVE-2012-2694](https://cve.now/CVE-2012-2694): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not… - Severity: Unrated - Published: Jun 22, 2012 - Affected: from 3.0.13, fixed in 3.0.14; from 3.1.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.6. ### [CVE-2012-2660](https://cve.now/CVE-2012-2660): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not… - Severity: Unrated - Published: Jun 22, 2012 - Affected: from 3.0.0.beta, fixed in 3.0.13; from 3.1.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.4; fixed in 2.3.16. ### [CVE-2012-1099](https://cve.now/CVE-2012-1099): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/form\_options\_helper.rb in the select helper in Ruby on… - Severity: Unrated - Published: Mar 13, 2012 - Affected: from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.4; from 3.2.0, fixed in 3.2.2. ### [CVE-2011-4319](https://cve.now/CVE-2011-4319): Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before… - Severity: Unrated - Published: Nov 28, 2011 - Affected: from 3.0.0, fixed in 3.0.11; from 3.1.0, fixed in 3.1.2. ### [CVE-2011-3187](https://cve.now/CVE-2011-3187): The to\_s method in actionpack/lib/action\_dispatch/middleware/remote\_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 2.3.0, fixed in 2.3.13. ### [CVE-2011-3186](https://cve.now/CVE-2011-3186): CRLF injection vulnerability in actionpack/lib/action\_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 2.3.0, fixed in 2.3.13. ### [CVE-2011-2931](https://cve.now/CVE-2011-2931): Cross-site scripting (XSS) vulnerability in the strip\_tags helper in actionpack/lib/action\_controller/vendor/html-scanner/html/node.rb in… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0, fixed in 3.0.10. ### [CVE-2011-2929](https://cve.now/CVE-2011-2929): The template selection functionality in actionpack/lib/action\_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 3.0.0, fixed in 3.0.10. ### [CVE-2011-2197](https://cve.now/CVE-2011-2197): The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does… - Severity: Unrated - Published: Jun 30, 2011 - Affected: from 2.0.0, fixed in 2.3.12; from 3.0.0, fixed in 3.0.8. ### [CVE-2011-0449](https://cve.now/CVE-2011-0449): actionpack/lib/action\_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not… - Severity: Unrated - Published: Feb 21, 2011 - Affected: from 3.0.0, fixed in 3.0.4. ### [CVE-2011-0447](https://cve.now/CVE-2011-0447): Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an… - Severity: Unrated - Published: Feb 14, 2011 - Affected: from 2.1.0, fixed in 2.3.11; from 3.0.0, fixed in 3.0.4. ### [CVE-2011-0446](https://cve.now/CVE-2011-0446): Multiple cross-site scripting (XSS) vulnerabilities in the mail\_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when… - Severity: Unrated - Published: Feb 14, 2011 - Affected: fixed in 2.3.11; from 3.0.0, fixed in 3.0.4. ### [CVE-2008-7248](https://cve.now/CVE-2008-7248): Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote… - Severity: Unrated - Published: Dec 16, 2009 - Affected: from 2.1.0, fixed in 2.1.3; from 2.2.0, fixed in 2.2.2. ### [CVE-2009-3086](https://cve.now/CVE-2009-3086): A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest… - Severity: Unrated - Published: Sep 8, 2009 - Affected: from 2.1.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4. ### [CVE-2009-3009](https://cve.now/CVE-2009-3009): Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject… - Severity: Unrated - Published: Sep 8, 2009 - Affected: from 2.0.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/actionpack Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.