Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
125 results · page 1 of 3
Sep 22, 2026Spree is an open source e-commerce solution built with Ruby on Rails.CVE-2026-94462 · Other software · spree · reported by GitHubHigh 7.1
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible prefixed cart IDs, associate an eligible guest cart with the attacker's account, and receive billing and shipping address data from the cart. Exploitation requires a guest cart with address data on a store that does not require login for checkout, and reassignment can also disrupt the guest's in-progress cart. This issue is fixed in versions 5.4.4 and 5.5.4.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Pay is a payments engine for Ruby on Rails 6.0 and higher.CVE-2026-70658 · Other software · pay-rails · reported by GitHubHigh 7.4
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.
- Product
- pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Alchemy is an open source content management system engine written in Ruby on Rails.CVE-2026-57579 · Other software · AlchemyCMS · reported by GitHubHigh 7.5
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.
- Product
- alchemy_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-53769 · Other software · avo-hq · reported by GitHubMedium 6.5
Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Doorkeeper is an OAuth 2 provider for Ruby on Rails.CVE-2026-44476 · Other software · doorkeeper-gem · reported by GitHubMedium 6.3
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because the Dynamic Client Registration feature creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for the client_secret_basic and client_secret_post authentication methods; since Doorkeeper treats a blank or missing secret as valid for non-confidential (public) clients, the secret is never verified. Only projects that have explicitly enabled Dynamic Client Registration, which is disabled by default, are affected. This issue is fixed in version 1.10.0.
- Product
- doorkeeper-openid_connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-55518 · Other software · avo-hq · reported by GitHubCritical 9.6
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsController#create. An authenticated low-privileged Avo user can bypass hidden or disabled attach controls and directly attach related records to a parent record by sending a crafted POST request, which can lead to privilege escalation and cross-tenant data exposure where associations represent authorization-bearing relationships. This issue is fixed in versions 3.32.1 and 4.0.0.beta.51.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.CVE-2026-54498 · Other software · ViewComponent · reported by GitHubHigh 8.7
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #call return values. This creates an XSS risk when downstream applications use around_render to wrap, replace, instrument, or conditionally return content that includes user-controlled data, and ViewComponent::Collection#render_in can amplify the issue by joining per-item results and marking the entire output html_safe, converting raw unsafe output into an ActiveSupport::SafeBuffer. This issue is fixed in version 4.12.0.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.CVE-2026-54497 · Other software · ViewComponent · reported by GitHubMedium 6.8
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same component, collection, or spacer component instance is reused across requests, users, tenants, or threads, later renders can use stale helpers, controller, request, view_flow, format/variant details, and slot child context from an earlier render. This can cause authorization-aware components to render privileged UI for a lower-privileged user, generate links using a stale Host header, leak slot/helper state, and mix request context under concurrent rendering. This issue is fixed in version 4.12.0.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.CVE-2026-44837 · Other software · ViewComponent · reported by GitHubMedium 5.9
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.CVE-2026-44836 · Other software · ViewComponent · reported by GitHubMedium 6.5
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-42205 · Other software · avo-hq · reported by GitHubHigh 8.8
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController of the Avo framework. Due to insecure action lookup logic, an authenticated user can execute any Action class (descendants of Avo::BaseAction) on any resource, even if the action is not registered for that specific resource. This leads to Privilege Escalation and unauthorized data manipulation across the entire application. This issue has been patched in version 3.31.2.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2026-33209 · Other software · avo-hq · reported by GitHubMedium 5.3
Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button. This issue has been patched in version 3.30.3.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Spree is an open source e-commerce solution built with Ruby on Rails.CVE-2026-25757 · Other software · spree · reported by GitHubHigh 7.7
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2, unauthenticated users can view completed guest orders by Order ID. This issue may lead to disclosure of PII of guest users (including names, addresses and phone numbers). This issue has been patched in versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Spree is an open source e-commerce solution built with Ruby on Rails.CVE-2026-25758 · Other software · spree · reported by GitHubHigh 7.7
Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Commerce's guest checkout flow that allows any guest user to bind arbitrary guest addresses to their order by manipulating address ID parameters. This enables unauthorized access to other guests' personally identifiable information (PII) including names, addresses and phone numbers. The vulnerability bypasses existing ownership validation checks and affects all guest checkout transactions. This vulnerability is fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, and 5.3.2.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Alchemy is an open source content management system engine written in Ruby on Rails.CVE-2026-23885 · Other software · AlchemyCMS · reported by GitHubMedium 6.4
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.
- Product
- alchemy_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Spree is an open source e-commerce solution built with Ruby on Rails.CVE-2026-22589 · Other software · spree · reported by GitHubHigh 7.5
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Unauthenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an unauthenticated attacker to access guest address information without supplying valid credentials or session cookies. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Spree is an open source e-commerce solution built with Ruby on Rails.CVE-2026-22588 · Other software · spree · reported by GitHubMedium 6.5
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference (IDOR) vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying an existing order. By editing an order they legitimately own and manipulating address identifiers in the request, the backend server accepts and processes references to addresses belonging to other users, subsequently associating those addresses with the attacker’s order and returning them in the response. This issue has been patched in versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails.CVE-2024-46987 · Other software · owen2345 · reported by GitHubHigh 7.7
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the web server Camaleon CMS is running on (depending on the file permissions). This issue may lead to Information Disclosure. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- camaleon-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comgithub.com
Sep 18, 2024Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails.CVE-2024-46986 · Other software · owen2345 · reported by GitHubCritical 9.9
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application. This issue has been addressed in release version 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- camaleon-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comgithub.com
Jul 19, 2024A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application.CVE-2024-39906 · Other software · havenweb · reported by GitHubHigh 8.3
A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- haven
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2024-27090 · Other software · decidim · reported by GitHubMedium 5.3
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be laterCVE-2024-37031 · Other software · reported by MITREMedium 6.1
The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2024-22411 · Other software · avo-hq · reported by GitHubMedium 6.5
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Avo is a framework to create admin panels for Ruby on Rails apps.CVE-2024-22191 · Other software · avo-hq · reported by GitHubHigh 7.3
Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2024view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.CVE-2024-21636 · Other software · ViewComponent · reported by GitHubMedium 6.1
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. Versions prior to 3.9.0 and 2.83.0 have a cross-site scripting vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a `#call` method (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content. In addition, the return value of the `#output_postamble` methodis not sanitized, which can also lead to cross-site scripting issues. Versions 3.9.0 and 2.83.0 have been released and fully mitigate both the `#call` and the `#output_postamble` vulnerabilities. As a workaround, sanitize the return value of `#call`.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2023-36465 · Other software · decidim · reported by GitHubCritical 9.1
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2023-34090 · Other software · decidim · reported by GitHubHigh 7.5
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table). This issue may lead to Sensitive Data Disclosure. The problem was patched in version 0.27.3.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2023-34089 · Other software · decidim · reported by GitHubHigh 8.1
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participatioCVE-2023-32693 · Other software · decidim · reported by GitHubHigh 8.1
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7.
- Product
- decidim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.CVE-2023-34246 · Other software · doorkeeper-gem · reported by GitHubMedium 4.2
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
- Product
- doorkeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Avo is an open source ruby on rails admin panel creation framework.CVE-2023-34103 · Other software · avo-hq · reported by GitHubHigh 7.3
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023Avo is an open source ruby on rails admin panel creation framework.CVE-2023-34102 · Other software · avo-hq · reported by GitHubHigh 8.3
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
- Product
- avo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Pay is a payments engine for Ruby on Rails 6.0 and higher.CVE-2023-30614 · Other software · pay-rails · reported by GitHubHigh 7.1
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2022A vulnerability classified as problematic has been found in Ruby on Rails.CVE-2022-3704 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
- Product
- Ruby on Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM).CVE-2022-39281 · Other software · fatfreecrm · reported by GitHubMedium 6.5
fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
- Product
- fat_free_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022VIewComponent is a framework for building view components in Ruby on Rails.CVE-2022-24722 · Other software · github · reported by GitHubHigh 8.1
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2021The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when deliveringCVE-2019-25025 · Other software · Rubyonrails · reported by MITREMedium 5.3
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
- Product
- Active Record Session Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2020Spree is a complete open source e-commerce solution built with Ruby on Rails.CVE-2020-26223 · Other software · spree · reported by GitHubHigh 7.7
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.
- Product
- spree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.CVE-2015-2784 · Other software · Papercrop Project · reported by MITRECritical 9.8
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
- Product
- Papercrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2019The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.CVE-2010-3299 · Other software · rails · reported by Red HatMedium 6.5
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comseclists.org
Apr 26, 2019The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allCVE-2015-9284 · Other software · Omniauth · reported by support@hackerone.comHigh 8.8
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
- Product
- Omniauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019Rails Ruby on Rails Path Traversal VulnerabilityCVE-2019-5418 · Other software · Rails · reported by support@hackerone.comExploitedHigh 7.5
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
- Product
- Ruby on Rails
- On CISA’s list since
- Jul 7, 2025 (federal fix deadline Jul 28, 2025)
- What to do
- Attackers are using this now. Install Rails’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloglists.opensuse.orgpacketstormsecurity.com
Dec 29, 2017SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' CVE-2017-17920 · Other software · Rubyonrails · reported by MITREHigh 8.1
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
- Product
- Ruby ON Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkay-malwarebenchmark.github.iokay-malwarebenchmark.github.io
Dec 29, 2017SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc'CVE-2017-17919 · Other software · rubyonrails · reported by MITREHigh 8.1
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
- Product
- ruby_on_rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkay-malwarebenchmark.github.iokay-malwarebenchmark.github.io
Dec 29, 2017SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' paraCVE-2017-17917 · Other software · Rubyonrails · reported by MITREHigh 8.1
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkay-malwarebenchmark.github.iokay-malwarebenchmark.github.io
Dec 29, 2017SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' CVE-2017-17916 · Other software · Rubyonrails · reported by MITREHigh 8.1
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkay-malwarebenchmark.github.iokay-malwarebenchmark.github.io
Sep 7, 2016Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSOCVE-2016-6317 · Other software · Rubyonrails · reported by Red HatHigh 7.5
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comweblog.rubyonrails.org
Sep 7, 2016Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attaCVE-2016-6316 · Other software · Rubyonrails · reported by Red HatMedium 6.1
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Apr 7, 2016Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveragingCVE-2016-2098 · Other software · Debian · reported by Red HatHigh 7.3
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Apr 7, 2016Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by levCVE-2016-2097 · Other software · Rubyonrails · reported by Red HatMedium 5.3
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.