Ruby on Rails
Security Risk Profile
33
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 37 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 4, 2009 to present
37
Total CVEs
4
Critical+High
1
Exploited
3
Unpatched
Threat Assessment
Avg CVSS
4.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
33/100
low
⚠️ 1 Active Exploits📈 2 in Last 30 Days
Severity Distribution
Critical
0High
4Medium
4Low
2Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
XSS
2
2
Path Traversal
1
3
Command Injection
1
4
Code Injection
1
5
CSRF
1
Most Affected Products
1. Mark Evans Dragonfly Gem52
2. Ruby on Rails Rails22
3. Ruby on Rails Active Storage (Active Storage framework)4
4. Ruby on Rails Ruby on Rails3
5. Ruby on Rails Active Storage2
Recent Vulnerabilities
See more →bleepingcomputer-20260801142030
unknown
Rails patches critical Active Storage flaw with RCE potential
8/1/2026⚠ Exploited🔧 No Patch
https://reddit.com/r/netsec/comments/1vauljz/kindarails2shell_arbitrary_file_read_to_rce_in/
unknown
KindaRails2Shell: arbitrary file read to RCE in Rails Active Storage via libvips (CVE-2026-66066)
7/30/2026🔧 No Patch
REDHAT-BUG-2450546
CVSS 7.0high
3/24/2026🔧 No Patch
REDHAT-BUG-2435565
CVSS 7.0high
1/30/2026🔧 No Patch
EOL-rails-8.1
unknown
10/22/2025
latest-version-rails-7.1
unknown
12/10/2024
EOL-rails-7.1
unknown
12/10/2024
EOL-rails-7.0
unknown
12/10/2024
latest-version-rails-7.0
unknown
12/10/2024
EOL-rails-8.0
unknown
12/10/2024
Monitor Ruby on Rails in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.