# Rubyonrails Rails


- [CVE-2019-5418](https://insights.sbomify.com/CVE-2019-5418/): Rails Ruby on Rails Path Traversal (high 7.5, exploited in the wild)
- [CVE-2016-0752](https://insights.sbomify.com/CVE-2016-0752/): Ruby on Rails Directory Traversal (high 7.5, exploited in the wild)
- [CVE-2014-0130](https://insights.sbomify.com/CVE-2014-0130/): Ruby on Rails Directory Traversal (high 7.5, exploited in the wild)
- [CVE-2013-0277](https://insights.sbomify.com/CVE-2013-0277/): Active Record contains deserialization of arbitrary YAML (critical 10.0)
- [CVE-2020-8165](https://insights.sbomify.com/CVE-2020-8165/): ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore (critical 9.8)
- [CVE-2019-5420](https://insights.sbomify.com/CVE-2019-5420/): Use of Insufficiently Random Values in Railties Allows Remote Code Execution (critical 9.8)
- [CVE-2020-8163](https://insights.sbomify.com/CVE-2020-8163/): Remote code execution via user-provided local names in ActionView (high 8.8)
- [CVE-2017-17916](https://insights.sbomify.com/CVE-2017-17916/): SQL injection in n/a (high 8.1)
- [CVE-2017-17917](https://insights.sbomify.com/CVE-2017-17917/): SQL injection in n/a (high 8.1)
- [CVE-2026-33195](https://insights.sbomify.com/CVE-2026-33195/): Rails Active Storage has possible Path Traversal in DiskService (high 8.0)
- [CVE-2022-23634](https://insights.sbomify.com/CVE-2022-23634/): Information Exposure when using Puma with Rails (high 8.0)
- [CVE-2024-26142](https://insights.sbomify.com/CVE-2024-26142/): Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/products/rubyonrails/rails/