Technology · RubyGems
activerecord (RubyGems) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 26 vulnerabilities in activerecord (RubyGems): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2025-55193, was published on 13 August 2025.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 1
- Exploited in the wild
- 0
About activerecord (RubyGems)
Ruby gem that provides object-relational mapping for database interaction within Rails applications.
Latest activerecord (RubyGems) vulnerabilities
- CVE-2025-55193: Active Record logging vulnerable to ANSI escape injectionmediumCVSS 4EPSS 0.6%
- CVE-2022-44566: Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapterlowCVSS 3.1EPSS 1.3%
- CVE-2023-22794: SQL Injection Vulnerability via ActiveRecord commentslowCVSS 3.1EPSS 2.1%
- CVE-2022-32224: Ruby on Rails Active Record RCE via YAML Deserialization in Serialized ColumnscriticalCVSS 9.8EPSS 2.5%
- CVE-2013-3221: Active Record component in Ruby on Rails has a data-type injection vulnerabilitymediumCVSS 4EPSS 2.0%
- CVE-2021-22880: Active Record subject to Regular Expression Denial-of-Service (ReDoS)lowCVSS 3.1EPSS 4.4%
- Moderate severity vulnerability that affects activerecordinfo
- High severity vulnerability that affects activerecordinfo
- Moderate severity vulnerability that affects activerecordinfo
- CVE-2011-2930: activerecord vulnerable to SQL InjectioninfoEPSS 2.3%
- CVE-2012-2661: Active Record vulnerable to SQL Injection via nested query parametersinfoEPSS 4.0%
- CVE-2012-2695: activerecord vulnerable to SQL InjectioninfoEPSS 2.9%
- CVE-2011-0448: activerecord vulnerable to SQL InjectioninfoEPSS 2.2%
- CVE-2008-4094: Rails ActiveRecord gem vulnerable to SQL injectioninfoEPSS 3.0%
- CVE-2010-3933: Rails activerecord gem has Improper Input Validation vulnerabilityinfoEPSS 2.2%
- CVE-2013-1854: Active Record Improper Input ValidationinfoEPSS 3.4%
- CVE-2013-0277: Active Record contains deserialization of arbitrary YAMLinfoEPSS 7.5%
- CVE-2013-0155: Active Record allows bypassing of database-query restrictionsinfoEPSS 8.3%
- CVE-2012-6496: Active Record contains SQL InjectioninfoEPSS 4.5%
- CVE-2013-0276: ActiveRecord vulnerable to modification of protected model attributesinfoEPSS 2.5%
- CVE-2014-0080: Array data injection vulnerability in activerecordinfoEPSS 1.3%
- CVE-2014-3514: Active Record subject to strong parameters protection bypassinfoEPSS 2.8%
- CVE-2014-3483: Active Record contains SQL Injection via improper range quotinginfoEPSS 4.2%
- CVE-2014-3482: SQL Injection in Active RecordinfoEPSS 4.3%
- CVE-2015-7577: Active Record Improper Access ControllowCVSS 3EPSS 4.3%
Most severe activerecord (RubyGems) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2022-32224: Ruby on Rails Active Record RCE via YAML Deserialization in Serialized ColumnscriticalCVSS 9.8EPSS 2.5%
- CVE-2013-3221: Active Record component in Ruby on Rails has a data-type injection vulnerabilitymediumCVSS 4EPSS 2.0%
- CVE-2025-55193: Active Record logging vulnerable to ANSI escape injectionmediumCVSS 4EPSS 0.6%
- CVE-2021-22880: Active Record subject to Regular Expression Denial-of-Service (ReDoS)lowCVSS 3.1EPSS 4.4%
- CVE-2023-22794: SQL Injection Vulnerability via ActiveRecord commentslowCVSS 3.1EPSS 2.1%
- CVE-2022-44566: Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapterlowCVSS 3.1EPSS 1.3%
- CVE-2015-7577: Active Record Improper Access ControllowCVSS 3EPSS 4.3%
- CVE-2016-6317: ActiveRecord in Ruby on Rails allows database-query bypasslowCVSS 3EPSS 3.9%
- CVE-2013-0155: Active Record allows bypassing of database-query restrictionsinfoEPSS 8.3%
- CVE-2013-0277: Active Record contains deserialization of arbitrary YAMLinfoEPSS 7.5%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many activerecord (RubyGems) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/rubygems-activerecord)<a href="https://junglewise.ai/threats/technologies/rubygems-activerecord"><img src="https://junglewise.ai/threats/technologies/rubygems-activerecord/badge.svg" alt="activerecord (RubyGems) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/rubygems-activerecord.json, and this page as text at https://junglewise.ai/threats/technologies/rubygems-activerecord.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "activerecord (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/rubygems-activerecord, 13 November 2026.