CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 5:00 AM ET)

What this means for you

This week: 3,332 CVEs published, 225 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,332; Show in the list
Critical, last 7 days: 225; Show in the list
Healthcare-tagged, last 7 days: 3; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product rubyonrails:rails. Show all products

14 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2014-0130 Known exploited	High 7.5	Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when… Assigned by redhat	May 7, 2014
CVE-2016-0752 Known exploited	High 7.5	Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read… Assigned by redhat	Feb 15, 2016
CVE-2019-5418 Known exploited	High 7.5	There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the targ… Assigned by hackerone	Mar 27, 2019
CVE-2023-22792	High 7.5	A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.	Feb 9, 2023
CVE-2023-22795	High 7.5	A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.	Feb 9, 2023
CVE-2026-33167	Low 1.3	Rails has a possible XSS vulnerability in its Action Pack debug exceptions Assigned by GitHub_M	Mar 23, 2026
CVE-2026-33169	Medium 6.9	Rails Active Support has a possible ReDoS vulnerability in number_to_delimited Assigned by GitHub_M	Mar 23, 2026
CVE-2026-33170	Medium 5.3	Rails Active Support has a possible XSS vulnerability in SafeBuffer#% Assigned by GitHub_M	Mar 23, 2026
CVE-2026-33173	Medium 5.3	Rails Active Storage has possible content type bypass via metadata in direct uploads Assigned by GitHub_M	Mar 23, 2026
CVE-2026-33174	Medium 6.6	Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests Assigned by GitHub_M	Mar 23, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.