{"schema_version":1,"title":"actionview (RubyGems) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in actionview (RubyGems): 4 in the last 7 days and 4 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-126079, was published on 10 November 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/actionview","json_url":"https://junglewise.ai/threats/technologies/actionview.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/actionview","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":19,"critical":2,"exploited":2,"last_7_days":4,"last_30_days":4,"last_90_days":4,"last_365_days":5},"latest":[{"cve":"CVE-2026-126079","cvss":6.1,"epss":0.0034,"slug":"cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View XSS via HTML5 sanitizer in text helpers","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:26.513+00:00","url":"https://junglewise.ai/threats/cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126078","cvss":6.1,"epss":0.0034,"slug":"cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View TextHelper highlight XSS","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:26.35+00:00","url":"https://junglewise.ai/threats/cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126070","cvss":6.1,"epss":0.0027,"slug":"cve-2026-126070-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View strip_tags XSS in HTML attributes","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:25.117+00:00","url":"https://junglewise.ai/threats/cve-2026-126070-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126069","cvss":4.7,"epss":0.0024,"slug":"cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Ruby on Rails Action View XSS in tag helpers via whitespace attribute names","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:24.96+00:00","url":"https://junglewise.ai/threats/cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-33168","cvss":4,"epss":0.0088,"slug":"cve-2026-33168-rails-has-a-possible-xss-vulnerability-in-its-action-view-tag","title":"Rails has a possible XSS vulnerability in its Action View tag helpers","severity":"medium","exploited":false,"published_at":"2026-03-23T20:51:18+00:00","url":"https://junglewise.ai/threats/cve-2026-33168-rails-has-a-possible-xss-vulnerability-in-its-action-view-tag"},{"cve":"CVE-2023-23913","cvss":3.1,"epss":0.0061,"slug":"cve-2023-23913-rails-ujs-vulnerable-to-dom-based-cross-site-scripting","title":"rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements","severity":"low","exploited":false,"published_at":"2023-06-09T22:41:16+00:00","url":"https://junglewise.ai/threats/cve-2023-23913-rails-ujs-vulnerable-to-dom-based-cross-site-scripting"},{"cve":"CVE-2022-27777","cvss":3.1,"epss":0.0164,"slug":"cve-2022-27777-xss-vulnerability-in-action-view-tag-helpers","title":"XSS Vulnerability in Action View tag helpers","severity":"low","exploited":false,"published_at":"2022-04-27T22:32:49+00:00","url":"https://junglewise.ai/threats/cve-2022-27777-xss-vulnerability-in-action-view-tag-helpers"},{"cve":"CVE-2020-15169","cvss":3.1,"epss":0.0237,"slug":"cve-2020-15169-xss-in-action-view","title":"XSS in Action View","severity":"low","exploited":false,"published_at":"2020-09-11T15:19:57+00:00","url":"https://junglewise.ai/threats/cve-2020-15169-xss-in-action-view"},{"cve":"CVE-2020-8163","cvss":3.1,"epss":0.8205,"slug":"cve-2020-8163-remote-code-execution-via-user-provided-local-names-in-actionview","title":"Remote code execution via user-provided local names in ActionView","severity":"low","exploited":false,"published_at":"2020-07-07T16:34:27+00:00","url":"https://junglewise.ai/threats/cve-2020-8163-remote-code-execution-via-user-provided-local-names-in-actionview"},{"cve":"CVE-2020-8167","cvss":3.1,"epss":0.0149,"slug":"cve-2020-8167-csrf-vulnerability-in-rails-ujs","title":"CSRF Vulnerability in rails-ujs","severity":"low","exploited":false,"published_at":"2020-07-07T16:34:10+00:00","url":"https://junglewise.ai/threats/cve-2020-8167-csrf-vulnerability-in-rails-ujs"},{"cve":"CVE-2020-5267","cvss":3.1,"epss":0.0153,"slug":"cve-2020-5267-cross-site-scripting-vulnerability-in-actionview","title":"Cross site scripting vulnerability in ActionView","severity":"low","exploited":false,"published_at":"2020-03-19T17:30:29+00:00","url":"https://junglewise.ai/threats/cve-2020-5267-cross-site-scripting-vulnerability-in-actionview"},{"cve":"CVE-2019-5418","cvss":3.1,"epss":0.9851,"slug":"cve-2019-5418-ruby-on-rails-path-traversal-in-action-view","title":"Path Traversal in Action View","severity":"critical","exploited":true,"published_at":"2019-03-13T17:26:59+00:00","url":"https://junglewise.ai/threats/cve-2019-5418-ruby-on-rails-path-traversal-in-action-view"},{"cve":"CVE-2019-5419","cvss":3.1,"epss":0.0867,"slug":"cve-2019-5419-denial-of-service-vulnerability-in-action-view","title":"Denial of Service Vulnerability in Action View","severity":"low","exploited":false,"published_at":"2019-03-13T17:25:55+00:00","url":"https://junglewise.ai/threats/cve-2019-5419-denial-of-service-vulnerability-in-action-view"},{"slug":"moderate-severity-vulnerability-that-affects-actionview-2697758f","title":"Moderate severity vulnerability that affects actionview","severity":"info","exploited":false,"published_at":"2018-09-17T21:55:54+00:00","url":"https://junglewise.ai/threats/moderate-severity-vulnerability-that-affects-actionview-2697758f"},{"slug":"moderate-severity-vulnerability-that-affects-actionview-f47f475d","title":"Moderate severity vulnerability that affects actionview","severity":"info","exploited":false,"published_at":"2018-08-13T20:48:52+00:00","url":"https://junglewise.ai/threats/moderate-severity-vulnerability-that-affects-actionview-f47f475d"},{"cve":"CVE-2011-0446","epss":0.0235,"slug":"cve-2011-0446-rails-actionpack-gem-vulnerable-to-cross-site-scripting","title":"Rails actionpack gem vulnerable to Cross-site Scripting","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2011-0446-rails-actionpack-gem-vulnerable-to-cross-site-scripting"},{"cve":"CVE-2016-0752","cvss":3,"epss":0.9554,"slug":"cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability","title":"Directory traversal vulnerability in Action View in Ruby on Rails","severity":"critical","exploited":true,"published_at":"2017-10-24T18:33:35+00:00","url":"https://junglewise.ai/threats/cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability"},{"cve":"CVE-2016-2097","cvss":3,"epss":0.0442,"slug":"cve-2016-2097-actionview-contains-path-traversal-vulnerability","title":"actionview contains Path Traversal vulnerability","severity":"low","exploited":false,"published_at":"2017-10-24T18:33:35+00:00","url":"https://junglewise.ai/threats/cve-2016-2097-actionview-contains-path-traversal-vulnerability"},{"cve":"CVE-2016-6316","cvss":3,"epss":0.0344,"slug":"cve-2016-6316-actionview-cross-site-scripting-vulnerability","title":"actionview Cross-site Scripting vulnerability","severity":"low","exploited":false,"published_at":"2017-10-24T18:33:35+00:00","url":"https://junglewise.ai/threats/cve-2016-6316-actionview-cross-site-scripting-vulnerability"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":4}],"related":[{"name":"actionpack (RubyGems)","slug":"actionpack","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/actionpack"},{"name":"nokogiri (RubyGems)","slug":"nokogiri","vulnerabilities":69,"url":"https://junglewise.ai/threats/technologies/nokogiri"},{"name":"rack (RubyGems)","slug":"rack","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/rack"},{"name":"activerecord (RubyGems)","slug":"rubygems-activerecord","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/rubygems-activerecord"},{"name":"rubygems-update (RubyGems)","slug":"rubygems-update","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rubygems-update"},{"name":"puppet (RubyGems)","slug":"puppet","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/puppet"},{"name":"activesupport (RubyGems)","slug":"activesupport","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/activesupport"},{"name":"activestorage (RubyGems)","slug":"activestorage","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/activestorage"},{"name":"camaleon_cms (RubyGems)","slug":"camaleon-cms","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/camaleon-cms"},{"name":"rails-html-sanitizer (RubyGems)","slug":"rails-html-sanitizer","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/rails-html-sanitizer"},{"name":"loofah (RubyGems)","slug":"loofah","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/loofah"},{"name":"publify_core (RubyGems)","slug":"publify-core","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/publify-core"}],"technology":{"hub":true,"name":"actionview (RubyGems)","slug":"actionview","vendor":{"hub":true,"name":"RubyGems","slug":"rubygems","url":"https://junglewise.ai/threats/vendors/rubygems"},"aliases":[],"homepage":"https://rubyonrails.org/","repo_url":"https://github.com/rails/rails/tree/main/actionview","description":"ActionView is a Rails framework component for rendering templates and managing views.","url":"https://junglewise.ai/threats/technologies/actionview"},"most_severe":[{"cve":"CVE-2019-5418","cvss":3.1,"epss":0.9851,"slug":"cve-2019-5418-ruby-on-rails-path-traversal-in-action-view","title":"Path Traversal in Action View","severity":"critical","exploited":true,"published_at":"2019-03-13T17:26:59+00:00","url":"https://junglewise.ai/threats/cve-2019-5418-ruby-on-rails-path-traversal-in-action-view"},{"cve":"CVE-2016-0752","cvss":3,"epss":0.9554,"slug":"cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability","title":"Directory traversal vulnerability in Action View in Ruby on Rails","severity":"critical","exploited":true,"published_at":"2017-10-24T18:33:35+00:00","url":"https://junglewise.ai/threats/cve-2016-0752-ruby-on-rails-directory-traversal-vulnerability"},{"cve":"CVE-2026-126079","cvss":6.1,"epss":0.0034,"slug":"cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View XSS via HTML5 sanitizer in text helpers","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:26.513+00:00","url":"https://junglewise.ai/threats/cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126078","cvss":6.1,"epss":0.0034,"slug":"cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View TextHelper highlight XSS","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:26.35+00:00","url":"https://junglewise.ai/threats/cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126070","cvss":6.1,"epss":0.0027,"slug":"cve-2026-126070-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Rails Action View strip_tags XSS in HTML attributes","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:25.117+00:00","url":"https://junglewise.ai/threats/cve-2026-126070-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-126069","cvss":4.7,"epss":0.0024,"slug":"cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and","title":"Ruby on Rails Action View XSS in tag helpers via whitespace attribute names","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:24.96+00:00","url":"https://junglewise.ai/threats/cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and"},{"cve":"CVE-2026-33168","cvss":4,"epss":0.0088,"slug":"cve-2026-33168-rails-has-a-possible-xss-vulnerability-in-its-action-view-tag","title":"Rails has a possible XSS vulnerability in its Action View tag helpers","severity":"medium","exploited":false,"published_at":"2026-03-23T20:51:18+00:00","url":"https://junglewise.ai/threats/cve-2026-33168-rails-has-a-possible-xss-vulnerability-in-its-action-view-tag"},{"cve":"CVE-2020-8163","cvss":3.1,"epss":0.8205,"slug":"cve-2020-8163-remote-code-execution-via-user-provided-local-names-in-actionview","title":"Remote code execution via user-provided local names in ActionView","severity":"low","exploited":false,"published_at":"2020-07-07T16:34:27+00:00","url":"https://junglewise.ai/threats/cve-2020-8163-remote-code-execution-via-user-provided-local-names-in-actionview"},{"cve":"CVE-2019-5419","cvss":3.1,"epss":0.0867,"slug":"cve-2019-5419-denial-of-service-vulnerability-in-action-view","title":"Denial of Service Vulnerability in Action View","severity":"low","exploited":false,"published_at":"2019-03-13T17:25:55+00:00","url":"https://junglewise.ai/threats/cve-2019-5419-denial-of-service-vulnerability-in-action-view"},{"cve":"CVE-2020-15169","cvss":3.1,"epss":0.0237,"slug":"cve-2020-15169-xss-in-action-view","title":"XSS in Action View","severity":"low","exploited":false,"published_at":"2020-09-11T15:19:57+00:00","url":"https://junglewise.ai/threats/cve-2020-15169-xss-in-action-view"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}