TI-2026-26038 CVE-2026-33658 · GHSA-p9fm-f462-ggrg
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Priority LOW 12
Active Storage allows users to attach cloud and local files in Rails applications.
Vulnerabilities
118 records
TI-2026-25623 CVE-2026-33202 · GHSA-73f9-jhhh-hr5m
Rails Active Storage has possible glob injection in its DiskService
Priority LOW 36
Active Storage allows users to attach cloud and local files in Rails applications.
TI-2026-25620 CVE-2026-33195 · GHSA-9xrj-h377-fr87
Rails Active Storage has possible Path Traversal in DiskService
Priority MEDIUM 44
Active Storage allows users to attach cloud and local files in Rails applications.
TI-2026-25606 CVE-2026-33176 · GHSA-2j26-frm8-cmj9
Rails Active Support has a possible DoS vulnerability in its number helpers
Priority LOW 37
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.
TI-2026-25604 CVE-2026-33174 · GHSA-r46p-8f7g-vvvg
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Priority LOW 36
Active Storage allows users to attach cloud and local files in Rails applications.
TI-2026-25603 CVE-2026-33173 · GHSA-qcfx-2mfw-w4cg
Rails Active Storage has possible content type bypass via metadata in direct uploads
Priority LOW 24
Active Storage allows users to attach cloud and local files in Rails applications.
TI-2026-25600 CVE-2026-33170 · GHSA-89vf-4333-qx8v
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Priority LOW 24
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.
TI-2026-25599 CVE-2026-33169 · GHSA-cg4j-q9v8-6v38
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Priority LOW 37
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.
TI-2026-25597 CVE-2026-33167 · GHSA-pgm4-439c-5jp6
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Priority LOW 8
Action Pack is a Rubygem for building web applications on the Rails framework.
TI-2024-21359 CVE-2024-32464 · GHSA-prjp-h48f-jgf6
ActionText ContentAttachment can Contain Unsanitized HTML
Priority LOW 28
Action Text brings rich text content and editing to Rails.
TI-2024-18684 CVE-2024-28103 · GHSA-fwhr-88qx-h9g7
Action Pack is missing security headers on non-HTML responses
Priority MEDIUM 43
Action Pack is a framework for handling and responding to web requests.
TI-2024-17234 CVE-2024-26144 · GHSA-8h22-8cf7-hq6g
Possible Sensitive Session Information Leak in Active Storage
Priority LOW 33
Rails is a web-application framework.
TI-2024-17233 CVE-2024-26143 · GHSA-9822-6m93-xqf4
Rails Possible XSS Vulnerability in Action Controller
Priority LOW 29
Rails is a web-application framework.
TI-2024-17232 CVE-2024-26142 · GHSA-jjhx-jhvp-74wq
Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Priority HIGH 66
Rails is a web-application framework.
TI-2023-08969 CVE-2023-22797 · GHSA-9445-4cr6-336r
Open redirect in https://github.com/rails/rails
Priority LOW 28
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input.
TI-2023-08967 CVE-2023-22795 · GHSA-8xww-x3g3-6jcv
Uncontrolled resource consumption in https://github.com/rails/rails
Priority LOW 37
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.
TI-2023-08965 CVE-2023-22792 · GHSA-p84v-45xj-wwqj
Uncontrolled resource consumption in https://github.com/rails/rails
Priority MEDIUM 42
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.
Priority MEDIUM 58
A vulnerability classified as problematic has been found in Ruby on Rails.
TI-2022-07686 CVE-2022-23634 · GHSA-rmj8-8hhh-gv5h
Information Exposure when using Puma with Rails
Priority MEDIUM 41
Puma is a Ruby/Rack web server built for parallelism.
TI-2022-07685 CVE-2022-23633 · GHSA-wh98-p28r-vrc9
Exposure of sensitive information in Action Pack
Priority LOW 37
Action Pack is a framework for handling and responding to web requests.
TI-2021-20128 CVE-2021-44528 · GHSA-qphc-hf5q-v8fc
Open redirect in https://github.com/rails/rails
Priority LOW 34
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middlewa…
TI-2011-01317 CVE-2011-1497 · GHSA-q58j-fmvf-9rq6
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
Priority LOW 30
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
TI-2021-05803 CVE-2021-22942 · GHSA-2rqw-v265-jf8c
Open redirect in https://github.com/rails/rails
Priority LOW 31
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
TI-2021-05765 CVE-2021-22904 · GHSA-7wjx-3g7j-8584
Uncontrolled resource consumption in https://github.com/rails/rails
Priority MEDIUM 41
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression.
TI-2021-05764 CVE-2021-22903 · GHSA-5hq2-xf89-9jxq
Open redirect in https://github.com/rails/rails
Priority LOW 30
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability.