{"schema_version":1,"title":"activesupport (RubyGems) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in activesupport (RubyGems): 2 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126080, was published on 10 November 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/activesupport","json_url":"https://junglewise.ai/threats/technologies/activesupport.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/activesupport","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":20,"critical":0,"exploited":0,"last_7_days":2,"last_30_days":2,"last_90_days":2,"last_365_days":5},"latest":[{"cve":"CVE-2026-126080","cvss":7.5,"slug":"cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard","title":"Rails Active Support regular expression injection in safe_constantize","severity":"high","exploited":false,"published_at":"2026-11-10T21:19:26.663+00:00","url":"https://junglewise.ai/threats/cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard"},{"cve":"CVE-2026-126075","cvss":4.7,"slug":"cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard","title":"Rails Active Support MessagePack unsafe serialization XSS","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:25.88+00:00","url":"https://junglewise.ai/threats/cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard"},{"cve":"CVE-2026-33176","cvss":4,"epss":0.0097,"slug":"cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its","title":"Rails Active Support has a possible DoS vulnerability in its number helpers","severity":"medium","exploited":false,"published_at":"2026-03-23T21:15:16+00:00","url":"https://junglewise.ai/threats/cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its"},{"cve":"CVE-2026-33170","cvss":4,"epss":0.0043,"slug":"cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer","title":"Ruby on Rails Active Support XSS in SafeBuffer","severity":"medium","exploited":false,"published_at":"2026-03-23T20:53:28+00:00","url":"https://junglewise.ai/threats/cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer"},{"cve":"CVE-2026-33169","cvss":4,"epss":0.0059,"slug":"cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number","title":"Rails Active Support has a possible ReDoS vulnerability in number_to_delimited","severity":"medium","exploited":false,"published_at":"2026-03-23T20:52:40+00:00","url":"https://junglewise.ai/threats/cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number"},{"cve":"CVE-2023-38037","cvss":3,"epss":0.0027,"slug":"cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files","title":"Active Support Possibly Discloses Locally Encrypted Files","severity":"low","exploited":false,"published_at":"2023-08-23T20:36:24+00:00","url":"https://junglewise.ai/threats/cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files"},{"cve":"CVE-2023-28120","cvss":3.1,"epss":0.0092,"slug":"cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice","title":"Possible XSS Security Vulnerability in SafeBuffer#bytesplice","severity":"low","exploited":false,"published_at":"2023-03-15T21:36:01+00:00","url":"https://junglewise.ai/threats/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice"},{"cve":"CVE-2023-22796","epss":0.0171,"slug":"cve-2023-22796-redos-based-dos-vulnerability-in-active-support-s-underscore","title":"ReDoS based DoS vulnerability in Active Support's underscore","severity":"info","exploited":false,"published_at":"2023-01-18T18:23:20+00:00","url":"https://junglewise.ai/threats/cve-2023-22796-redos-based-dos-vulnerability-in-active-support-s-underscore"},{"cve":"CVE-2020-8165","cvss":3.1,"epss":0.4573,"slug":"cve-2020-8165-activesupport-potentially-unintended-unmarshalling-of-user","title":"ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore","severity":"low","exploited":false,"published_at":"2020-05-26T14:49:24+00:00","url":"https://junglewise.ai/threats/cve-2020-8165-activesupport-potentially-unintended-unmarshalling-of-user"},{"slug":"moderate-severity-vulnerability-that-affects-activesupport-ce7c04ad","title":"Moderate severity vulnerability that affects activesupport","severity":"info","exploited":false,"published_at":"2018-09-17T21:57:23+00:00","url":"https://junglewise.ai/threats/moderate-severity-vulnerability-that-affects-activesupport-ce7c04ad"},{"cve":"CVE-2011-2197","epss":0.0196,"slug":"cve-2011-2197-rails-cross-site-scripting-vulnerability","title":"rails Cross-site Scripting vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2011-2197-rails-cross-site-scripting-vulnerability"},{"cve":"CVE-2011-2932","epss":0.0249,"slug":"cve-2011-2932-activesupport-cross-site-scripting-vulnerability","title":"activesupport Cross-site Scripting vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2011-2932-activesupport-cross-site-scripting-vulnerability"},{"cve":"CVE-2009-3086","epss":0.0223,"slug":"cve-2009-3086-actionpack-and-activesupport-vulnerable-to-information-leaks","title":"actionpack and activesupport vulnerable to information leaks","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2009-3086-actionpack-and-activesupport-vulnerable-to-information-leaks"},{"cve":"CVE-2012-1098","epss":0.0275,"slug":"cve-2012-1098-activesupport-cross-site-scripting-vulnerability","title":"activesupport Cross-site Scripting vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2012-1098-activesupport-cross-site-scripting-vulnerability"},{"cve":"CVE-2009-3009","epss":0.0302,"slug":"cve-2009-3009-cross-site-scripting-that-affects-rails","title":"Cross site scripting that affects rails","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:38+00:00","url":"https://junglewise.ai/threats/cve-2009-3009-cross-site-scripting-that-affects-rails"},{"cve":"CVE-2013-0333","epss":0.9533,"slug":"cve-2013-0333-activesupport-in-rails-vulnerable-to-incorrect-data-conversion","title":"activesupport in Rails vulnerable to incorrect data conversion","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:37+00:00","url":"https://junglewise.ai/threats/cve-2013-0333-activesupport-in-rails-vulnerable-to-incorrect-data-conversion"},{"cve":"CVE-2012-3464","epss":0.0257,"slug":"cve-2012-3464-activesupport-cross-site-scripting-vulnerability","title":"activesupport Cross-site Scripting vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:37+00:00","url":"https://junglewise.ai/threats/cve-2012-3464-activesupport-cross-site-scripting-vulnerability"},{"cve":"CVE-2013-1856","epss":0.0205,"slug":"cve-2013-1856-activesupport-improper-input-validation-vulnerability","title":"activesupport Improper Input Validation vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:37+00:00","url":"https://junglewise.ai/threats/cve-2013-1856-activesupport-improper-input-validation-vulnerability"},{"cve":"CVE-2015-3226","epss":0.0278,"slug":"cve-2015-3226-activesupport-cross-site-scripting-vulnerability","title":"activesupport Cross-site Scripting vulnerability","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/cve-2015-3226-activesupport-cross-site-scripting-vulnerability"},{"cve":"CVE-2015-3227","epss":0.0426,"slug":"cve-2015-3227-activesupport-vulnerable-to-denial-of-service-via-large-xml","title":"activesupport vulnerable to Denial of Service via large XML document depth","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/cve-2015-3227-activesupport-vulnerable-to-denial-of-service-via-large-xml"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":2}],"related":[{"name":"actionpack (RubyGems)","slug":"actionpack","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/actionpack"},{"name":"nokogiri (RubyGems)","slug":"nokogiri","vulnerabilities":69,"url":"https://junglewise.ai/threats/technologies/nokogiri"},{"name":"rack (RubyGems)","slug":"rack","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/rack"},{"name":"activerecord (RubyGems)","slug":"rubygems-activerecord","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/rubygems-activerecord"},{"name":"rubygems-update (RubyGems)","slug":"rubygems-update","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rubygems-update"},{"name":"puppet (RubyGems)","slug":"puppet","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/puppet"},{"name":"actionview (RubyGems)","slug":"actionview","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/actionview"},{"name":"activestorage (RubyGems)","slug":"activestorage","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/activestorage"},{"name":"camaleon_cms (RubyGems)","slug":"camaleon-cms","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/camaleon-cms"},{"name":"rails-html-sanitizer (RubyGems)","slug":"rails-html-sanitizer","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/rails-html-sanitizer"},{"name":"loofah (RubyGems)","slug":"loofah","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/loofah"},{"name":"publify_core (RubyGems)","slug":"publify-core","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/publify-core"}],"technology":{"hub":true,"name":"activesupport (RubyGems)","slug":"activesupport","vendor":{"hub":true,"name":"RubyGems","slug":"rubygems","url":"https://junglewise.ai/threats/vendors/rubygems"},"aliases":[],"homepage":"https://rubyonrails.org/","repo_url":"https://github.com/rails/rails/tree/main/activesupport","description":"Ruby on Rails utility library providing extensions and helpers for common programming tasks.","url":"https://junglewise.ai/threats/technologies/activesupport"},"most_severe":[{"cve":"CVE-2026-126080","cvss":7.5,"slug":"cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard","title":"Rails Active Support regular expression injection in safe_constantize","severity":"high","exploited":false,"published_at":"2026-11-10T21:19:26.663+00:00","url":"https://junglewise.ai/threats/cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard"},{"cve":"CVE-2026-126075","cvss":4.7,"slug":"cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard","title":"Rails Active Support MessagePack unsafe serialization XSS","severity":"medium","exploited":false,"published_at":"2026-11-10T21:19:25.88+00:00","url":"https://junglewise.ai/threats/cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard"},{"cve":"CVE-2026-33176","cvss":4,"epss":0.0097,"slug":"cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its","title":"Rails Active Support has a possible DoS vulnerability in its number helpers","severity":"medium","exploited":false,"published_at":"2026-03-23T21:15:16+00:00","url":"https://junglewise.ai/threats/cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its"},{"cve":"CVE-2026-33169","cvss":4,"epss":0.0059,"slug":"cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number","title":"Rails Active Support has a possible ReDoS vulnerability in number_to_delimited","severity":"medium","exploited":false,"published_at":"2026-03-23T20:52:40+00:00","url":"https://junglewise.ai/threats/cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number"},{"cve":"CVE-2026-33170","cvss":4,"epss":0.0043,"slug":"cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer","title":"Ruby on Rails Active Support XSS in SafeBuffer","severity":"medium","exploited":false,"published_at":"2026-03-23T20:53:28+00:00","url":"https://junglewise.ai/threats/cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer"},{"cve":"CVE-2020-8165","cvss":3.1,"epss":0.4573,"slug":"cve-2020-8165-activesupport-potentially-unintended-unmarshalling-of-user","title":"ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore","severity":"low","exploited":false,"published_at":"2020-05-26T14:49:24+00:00","url":"https://junglewise.ai/threats/cve-2020-8165-activesupport-potentially-unintended-unmarshalling-of-user"},{"cve":"CVE-2023-28120","cvss":3.1,"epss":0.0092,"slug":"cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice","title":"Possible XSS Security Vulnerability in SafeBuffer#bytesplice","severity":"low","exploited":false,"published_at":"2023-03-15T21:36:01+00:00","url":"https://junglewise.ai/threats/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice"},{"cve":"CVE-2023-38037","cvss":3,"epss":0.0027,"slug":"cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files","title":"Active Support Possibly Discloses Locally Encrypted Files","severity":"low","exploited":false,"published_at":"2023-08-23T20:36:24+00:00","url":"https://junglewise.ai/threats/cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files"},{"cve":"CVE-2013-0333","epss":0.9533,"slug":"cve-2013-0333-activesupport-in-rails-vulnerable-to-incorrect-data-conversion","title":"activesupport in Rails vulnerable to incorrect data conversion","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:37+00:00","url":"https://junglewise.ai/threats/cve-2013-0333-activesupport-in-rails-vulnerable-to-incorrect-data-conversion"},{"cve":"CVE-2015-3227","epss":0.0426,"slug":"cve-2015-3227-activesupport-vulnerable-to-denial-of-service-via-large-xml","title":"activesupport vulnerable to Denial of Service via large XML document depth","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/cve-2015-3227-activesupport-vulnerable-to-denial-of-service-via-large-xml"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}