R
Ruby on Rails
Security Risk Profile
33
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 37 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 4, 2009 to present
37
Total CVEs
4
Critical+High
1
Exploited
3
Unpatched
Threat Assessment
Avg CVSS
4.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
33/100
low
⚠️ 1 Active Exploits
Severity Distribution
Critical
0High
4Medium
4Low
2Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
XSS
2
2
Path Traversal
1
3
Command Injection
1
4
Code Injection
1
5
CSRF
1
Most Affected Products
1. Mark Evans Dragonfly Gem52
2. Ruby on Rails Rails22
3. Ruby on Rails Active Storage (Active Storage framework)4
4. Ruby on Rails Ruby on Rails3
5. Ruby on Rails Active Storage2
Recent Vulnerabilities
See more →bleepingcomputer-20260801142030
unknown
Rails patches critical Active Storage flaw with RCE potential
Aug 1, 2026⚠ Exploited🔧 No Patch
https://reddit.com/r/netsec/comments/1vauljz/kindarails2shell_arbitrary_file_read_to_rce_in/
unknown
KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)
Jul 30, 2026🔧 No Patch
REDHAT-BUG-2450546
CVSS 7.0high
Mar 24, 2026🔧 No Patch
REDHAT-BUG-2435565
CVSS 7.0high
Jan 30, 2026🔧 No Patch
EOL-rails-8.1
unknown
Oct 22, 2025
latest-version-rails-7.1
unknown
Dec 10, 2024
EOL-rails-7.1
unknown
Dec 10, 2024
EOL-rails-7.0
unknown
Dec 10, 2024
latest-version-rails-7.0
unknown
Dec 10, 2024
EOL-rails-8.0
unknown
Dec 10, 2024
Monitor Ruby on Rails in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.