Patchfirst
Patchfirst

Vendor

Rails

3 of 6 Rails CVEs in Patchfirst (50%) are in of vulnerabilities exploited in the wild.

CVEs
6
In CISA KEV
350%
Known ransomware use
0
Median days to KEV
2,294
from publication
Latest KEV listing
7 Jul 2025
Watch Rails Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Ruby on Rails In KEV: 3 CVEs: 3
  • actionview In KEV: 0 CVEs: 1
  • https://github.com/rails/rails In KEV: 0 CVEs: 1
  • rails In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Rails CVEs
Open in ATT&CK Navigator

Counts are Rails CVEs linked to the technique. Each link’s provenance is on the CVE page.

Rails CVEs

6 CVEs, by priority
  1. CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
    rails · railsPublic exploitCritical · 9.5
    30.1%Top 1.8%
    78.7priority
  2. CVE-2019-5418Rails Ruby on Rails Path Traversal Vulnerability
    Rails · Ruby on RailsKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1005Data from Local System
    98.5%Top 0.08%
    68.2priority
  3. CVE-2016-0752Ruby on Rails Directory Traversal Vulnerability
    Rails · Ruby on RailsKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1005Data from Local System
    95.5%Top 0.13%
    68.2priority
  4. CVE-2014-0130Ruby on Rails Directory Traversal Vulnerability
    Rails · Ruby on RailsKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1005Data from Local System
    53.7%Top 1%
    68.0priority
  5. CVE-2019-5420A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess…
    Rails · https://github.com/rails/railsPublic exploit
    89.3%Top 0.22%
    25.6priority
  6. CVE-2020-5267Possible XSS vulnerability in ActionView
    rails · actionviewPublic exploitMedium · 4.0T1059Command and Scripting InterpreterT1185Browser Session Hijacking
    1.5%Top 25%
    22.7priority
↑ ↓ chooseEnter openEsc close