Read the docs

Rails

Records164All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high43CVSS 7.0–8.9

Exploited now

Rails records in CISA KEV
TI-2019-03828 Rails Ruby on Rails Path Traversal Vulnerability Priority CRITICAL 90KEV 2025-07-07TI-2014-00124 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 92KEV 2022-03-25TI-2016-00672 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Rails 118 records CRITICAL Ruby On Rails 49 records HIGH Rails Html Sanitizers 10 records MEDIUM Html Sanitizer 4 records LOW Actionpack 2 records LOW Actionpack Page-caching 2 records MEDIUM Actionview 1 record LOW Active Record Session Store 1 record LOW

Records

4 records in Html Sanitizer · all components

TI-2015-06304 CVE-2015-7580 · GHSA-ghqm-pgxj-37gq

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the…

Priority LOW 32

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a cr…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02188 Published 2016-02-16 Fixed in 1.0.3 CWE-79
TI-2015-06303 CVE-2015-7579 · GHSA-r9c2-cr39-c8g6

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby…

Priority LOW 32

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the R…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02577 Published 2016-02-16 Fixed in 1.0.3 CWE-79
TI-2018-02738 CVE-2018-3741 · GHSA-px3r-jm9g-c8w8

Cross-site scripting in rails-html-sanitizer

Priority LOW 30

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01253 Published 2018-03-30 Partial fix · 1.0.4 CWE-79
Open these records in search →