Known Vulnerabilities for Rails by Rails
Listed below are 10 of the newest known vulnerabilities associated with "Rails" by "Rails".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-95813 json | e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and control... | Not Provided | 2026-09-22 | 2026-09-26 |
| CVE-2026-94462 json | Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/c... | Not Provided | 2026-09-22 | 2026-09-22 |
| CVE-2026-73648 json | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML:... | Not Provided | 2026-08-13 | 2026-08-13 |
| CVE-2026-73330 json | CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute... | Not Provided | 2026-08-12 | 2026-08-14 |
| CVE-2026-70665 json | Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. P... | Not Provided | 2026-08-25 | 2026-08-27 |
| CVE-2026-70658 json | Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_sign... | Not Provided | 2026-09-14 | 2026-09-14 |
| CVE-2026-67990 json | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and P... | Not Provided | 2026-08-13 | 2026-08-13 |
| CVE-2026-66066 json | Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Ac... | Not Provided | 2026-07-30 | 2026-08-05 |
| CVE-2026-57579 json | Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2... | Not Provided | 2026-09-14 | 2026-09-14 |
| CVE-2026-55518 json | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach... | Not Provided | 2026-07-17 | 2026-07-20 |