Rails vulnerabilities
68 CVEs and advisories name Rails as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-126188Active Storage: Possible local file disclosure in Active Storage video previews and analysis
- CVE-2026-126186Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
- CVE-2026-126085Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
- CVE-2026-126084Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
- CVE-2026-126083Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
- CVE-2026-126082Active Storage: Possible arbitrary file write and read in Active Storage image analysis
- CVE-2026-126081Action Pack: Possible Strong Parameters bypass in Parameters#each_key
- CVE-2026-126080Active Support: Possible DoS vulnerability in Active Support safe_constantize
- CVE-2026-126079Action View: Possible XSS vulnerability in Action View text helpers
- CVE-2026-126078Action View: Possible XSS vulnerability in Action View highlight helper
- CVE-2026-126077Action Pack: Possible sensitive session information leak in Active Storage proxy mode
- CVE-2026-126076Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
- CVE-2026-126075Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
- CVE-2026-126074Active Storage: Possible DoS vulnerability in Active Storage filename handling
- CVE-2026-126073Action Pack: Possible cache poisoning in Action Pack content negotiation
- CVE-2026-126072Action Pack: Possible DoS vulnerability in Action Controller Live streaming
- CVE-2026-126071Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
- CVE-2026-126070Action View: Possible XSS vulnerability in Action View strip_tags
- CVE-2026-126069Action View: Possible XSS vulnerability in Action View tag helpers
- CVE-2026-126068Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress
- CVE-2026-126067Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurations
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
- CVE-2026-33202Rails Active Storage has possible glob injection in its DiskService
- CVE-2026-33195Rails Active Storage has possible Path Traversal in DiskService
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpers
- CVE-2026-33174Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
- CVE-2026-33173Rails Active Storage has possible content type bypass via metadata in direct uploads
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%