Read the docs

Rails

Records164All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high43CVSS 7.0–8.9

Exploited now

Rails records in CISA KEV
TI-2019-03828 Rails Ruby on Rails Path Traversal Vulnerability Priority CRITICAL 90KEV 2025-07-07TI-2014-00124 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 92KEV 2022-03-25TI-2016-00672 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Rails 118 records CRITICAL Ruby On Rails 49 records HIGH Rails Html Sanitizers 10 records MEDIUM Html Sanitizer 4 records LOW Actionpack 2 records LOW Actionpack Page-caching 2 records MEDIUM Actionview 1 record LOW Active Record Session Store 1 record LOW

Records

1 record in Active Record Session Store · all components

TI-2019-15165 CVE-2019-25025 · GHSA-cvw2-xj8r-mjf7

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3…

Priority LOW 28

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01835 Published 2021-03-05 Partial fix · 2.0.0 CWE-208
Open these records in search →