Patchfirst: Rails vulnerabilitieshttps://patchfirst.co/vendor/rails/New and newly exploited Rails CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-66066: Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processinghttps://patchfirst.co/cve/CVE-2026-66066/CVE-2026-66066Thu, 30 Jul 2026 00:00:00 GMTrails · rails. Not in CISA KEV. EPSS 30.1% (higher than 98.2% of CVEs). CVSS 9.5 CRITICAL. Public exploit code exists. Priority 78.7 of 100.public-exploit[KEV] CVE-2019-5418: Rails Ruby on Rails Path Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-5418/CVE-2019-5418#kevMon, 07 Jul 2025 00:00:00 GMTRails · Ruby on Rails. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005[KEV] CVE-2016-0752: Ruby on Rails Directory Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2016-0752/CVE-2016-0752#kevFri, 25 Mar 2022 00:00:00 GMTRails · Ruby on Rails. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 95.5% (higher than 99.87% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.kevpublic-exploitT1190T1005[KEV] CVE-2014-0130: Ruby on Rails Directory Traversal Vulnerabilityhttps://patchfirst.co/cve/CVE-2014-0130/CVE-2014-0130#kevFri, 25 Mar 2022 00:00:00 GMTRails · Ruby on Rails. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 53.7% (higher than 99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.kevpublic-exploitT1190T1005CVE-2020-5267: Possible XSS vulnerability in ActionViewhttps://patchfirst.co/cve/CVE-2020-5267/CVE-2020-5267Thu, 19 Mar 2020 00:00:00 GMTrails · actionview. Not in CISA KEV. EPSS 1.5% (higher than 74.6% of CVEs). CVSS 4.0 MEDIUM. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1185 Browser Session Hijacking. Priority 22.7 of 100.public-exploitT1059T1185CVE-2019-5420: A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess…https://patchfirst.co/cve/CVE-2019-5420/CVE-2019-5420Wed, 27 Mar 2019 00:00:00 GMTRails · https://github.com/rails/rails. Not in CISA KEV. EPSS 89.3% (higher than 99.78% of CVEs). Public exploit code exists. Priority 25.6 of 100.public-exploit