# actionpack (RubyGems) vulnerabilities Source: https://junglewise.ai/threats/technologies/actionpack Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/actionpack.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 77 vulnerabilities in actionpack (RubyGems): 7 in the last 7 days and 7 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-126083, was published on 10 November 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 7 - Last 30 days: 7 - Last 90 days: 7 - All time: 77 (2 critical, 2 exploited in the wild) ## About actionpack (RubyGems) Ruby on Rails framework component handling HTTP request routing, controller logic, and response rendering. ## Latest actionpack (RubyGems) vulnerabilities - [CVE-2026-126083: Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-126081: Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-126077: Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-126076: Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 4.2, published 10 Nov 2026) - [CVE-2026-126073: Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 4.8, published 10 Nov 2026) - [CVE-2026-126072: Rails Action Pack thread exhaustion in ActionController::Live](https://junglewise.ai/threats/cve-2026-126072-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-126067: Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores](https://junglewise.ai/threats/cve-2026-126067-action-pack-is-a-framework-for-handling-and-responding-to-web) (low, CVSS 3.1, published 10 Nov 2026) - [CVE-2026-33167: Rails has a possible XSS vulnerability in its Action Pack debug exceptions](https://junglewise.ai/threats/cve-2026-33167-rails-has-a-possible-xss-vulnerability-in-its-action-pack-debug) (medium, CVSS 4, published 23 Mar 2026) - [CVE-2024-54133: Possible Content Security Policy bypass in Action Dispatch](https://junglewise.ai/threats/cve-2024-54133-possible-content-security-policy-bypass-in-action-dispatch) (medium, CVSS 4, published 10 Dec 2024) - [CVE-2024-47887: Possible ReDoS vulnerability in HTTP Token authentication in Action Controller](https://junglewise.ai/threats/cve-2024-47887-possible-redos-vulnerability-in-http-token-authentication-in) (medium, CVSS 4, published 15 Oct 2024) - [CVE-2024-41128: Possible ReDoS vulnerability in query parameter filtering in Action Dispatch](https://junglewise.ai/threats/cve-2024-41128-possible-redos-vulnerability-in-query-parameter-filtering-in) (medium, CVSS 4, published 15 Oct 2024) - [CVE-2024-28103: Missing security headers in Action Pack on non-HTML responses](https://junglewise.ai/threats/cve-2024-28103-missing-security-headers-in-action-pack-on-non-html-responses) (low, CVSS 3.1, published 4 Jun 2024) - [CVE-2024-26143: Rails has possible XSS Vulnerability in Action Controller](https://junglewise.ai/threats/cve-2024-26143-rails-has-possible-xss-vulnerability-in-action-controller) (low, CVSS 3.1, published 27 Feb 2024) - [CVE-2024-26142: Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch](https://junglewise.ai/threats/cve-2024-26142-rails-has-possible-redos-vulnerability-in-accept-header-parsing) (info, published 27 Feb 2024) - [CVE-2023-28362: Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to](https://junglewise.ai/threats/cve-2023-28362-actionpack-has-possible-cross-site-scripting-vulnerability-via) (low, CVSS 3.1, published 29 Jun 2023) - [CVE-2023-22792: ReDoS based DoS vulnerability in Action Dispatch](https://junglewise.ai/threats/cve-2023-22792-redos-based-dos-vulnerability-in-action-dispatch) (info, published 18 Jan 2023) - [CVE-2023-22797: Open Redirect Vulnerability in Action Pack](https://junglewise.ai/threats/cve-2023-22797-open-redirect-vulnerability-in-action-pack) (low, CVSS 3.1, published 18 Jan 2023) - [CVE-2023-22795: ReDoS based DoS vulnerability in Action Dispatch](https://junglewise.ai/threats/cve-2023-22795-redos-based-dos-vulnerability-in-action-dispatch) (info, published 18 Jan 2023) - [CVE-2022-3704: Cross-site Scripting in actionpack](https://junglewise.ai/threats/cve-2022-3704-cross-site-scripting-in-actionpack) (low, CVSS 3.1, published 27 Oct 2022) - [CVE-2022-22577: Cross-site Scripting Vulnerability in Action Pack](https://junglewise.ai/threats/cve-2022-22577-cross-site-scripting-vulnerability-in-action-pack) (low, CVSS 3.1, published 27 Apr 2022) - [CVE-2011-1497: Cross site scripting in actionpack Rubygem](https://junglewise.ai/threats/cve-2011-1497-cross-site-scripting-in-actionpack-rubygem) (low, CVSS 3.1, published 22 Apr 2022) - [CVE-2022-23633: Exposure of information in Action Pack](https://junglewise.ai/threats/cve-2022-23633-exposure-of-information-in-action-pack) (low, CVSS 3.1, published 11 Feb 2022) - [CVE-2021-44528: actionpack Open Redirect in Host Authorization Middleware](https://junglewise.ai/threats/cve-2021-44528-actionpack-open-redirect-in-host-authorization-middleware) (low, CVSS 3.1, published 14 Dec 2021) - [CVE-2021-22942: Open Redirect in ActionPack](https://junglewise.ai/threats/cve-2021-22942-open-redirect-in-actionpack) (low, CVSS 3.1, published 26 Aug 2021) - [CVE-2021-22904: Possible DoS Vulnerability in Action Controller Token Authentication](https://junglewise.ai/threats/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token) (low, CVSS 3.1, published 5 May 2021) ## Most severe actionpack (RubyGems) vulnerabilities - [CVE-2014-0130: actionpack Path Traversal vulnerability](https://junglewise.ai/threats/cve-2014-0130-ruby-on-rails-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 24 Oct 2017) - [CVE-2016-0752: Directory traversal vulnerability in Action View in Ruby on Rails](https://junglewise.ai/threats/cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 3, published 24 Oct 2017) - [CVE-2026-126081: Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-126083: Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web) (high, CVSS 7.4, published 10 Nov 2026) - [CVE-2026-126077: Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-126072: Rails Action Pack thread exhaustion in ActionController::Live](https://junglewise.ai/threats/cve-2026-126072-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-126073: Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 4.8, published 10 Nov 2026) - [CVE-2026-126076: Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web) (medium, CVSS 4.2, published 10 Nov 2026) - [CVE-2024-41128: Possible ReDoS vulnerability in query parameter filtering in Action Dispatch](https://junglewise.ai/threats/cve-2024-41128-possible-redos-vulnerability-in-query-parameter-filtering-in) (medium, CVSS 4, published 15 Oct 2024) - [CVE-2024-47887: Possible ReDoS vulnerability in HTTP Token authentication in Action Controller](https://junglewise.ai/threats/cve-2024-47887-possible-redos-vulnerability-in-http-token-authentication-in) (medium, CVSS 4, published 15 Oct 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 7 | 0 | 0 | ## Other RubyGems technologies - [nokogiri (RubyGems)](https://junglewise.ai/threats/technologies/nokogiri): 69 vulnerabilities - [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack): 55 vulnerabilities - [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord): 26 vulnerabilities - [rubygems-update (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-update): 25 vulnerabilities - [puppet (RubyGems)](https://junglewise.ai/threats/technologies/puppet): 23 vulnerabilities - [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport): 20 vulnerabilities - [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview): 19 vulnerabilities - [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage): 19 vulnerabilities - [camaleon_cms (RubyGems)](https://junglewise.ai/threats/technologies/camaleon-cms): 19 vulnerabilities - [rails-html-sanitizer (RubyGems)](https://junglewise.ai/threats/technologies/rails-html-sanitizer): 18 vulnerabilities - [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah): 17 vulnerabilities - [publify_core (RubyGems)](https://junglewise.ai/threats/technologies/publify-core): 15 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "actionpack (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/actionpack, 13 November 2026.