Known vulnerabilities in rubygem-actionpack

Known vulnerabilities in rubygem-actionpack

Vendor: Fedoraproject

Software: rubygem-actionpack

Software CPE: cpe:2.3:o:fedoraproject:rubygem-actionpack:*:*:*:*:*:fedora:*:*

Website: https://getfedora.org/

Total vulnerabilities: 15

Public exploits: 3

Known exploited (KEV): 1

Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Vulnerabilities (15)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU124275 - Uncontrolled Memory Allocation CVE-2026-33174	CWE-789	Medium	No	No	8.1.3.1-1.fc45	24.03.2026	SB2026032459 SB2026080548
#VU73274 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2023-28120	CWE-79	Medium	No	No	7.0.4.3-1.fc37, 7.0.4.3-1.fc38	14.03.2023	SB2023031410 SB2023041501 SB2023042648 and 13 more
#VU50607 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2021-22881	CWE-601	Low	No	No	6.0.3.4-2.fc33	11.02.2021	SB2021021104 SB2021030562
#VU50606 - Incorrect Regular Expression CVE-2021-22880	CWE-185	Medium	No	No	6.0.3.4-2.fc33	11.02.2021	SB2021021104 SB2021061020 SB2021100413 and 3 more
#VU46724 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2020-15169	CWE-79	Low	No	No	6.0.3.3-2.fc33, 6.0.3.3-2.fc34	11.09.2020	SB2020091507 SB2020092504 SB2023042728 and 3 more
#VU29212 - Improper Authorization CVE-2020-8185	CWE-285	High	No	No	6.0.3.3-2.fc33, 6.0.3.3-2.fc34	23.06.2020	SB2020062316 SB2020092525 SB20200930127
#VU26248 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2020-5267	CWE-79	Low	Available	No	6.0.3.3-2.fc33, 6.0.3.3-2.fc34	20.03.2020	SB2020032004 SB2020051128 SB2020092525 and 1 more
#VU8585 - Resource exhaustion CVE-2016-0751	CWE-400	Low	No	No	4.2.0-3.fc22, 4.2.3-4.fc23	22.09.2017	SB2016042501 SB2016013103 SB2016021014
#VU8575 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2016-6316	CWE-79	Low	No	No	5.0.0.1-2.fc25	14.09.2016	SB2016091402 SB2016082603 SB2016081711 and 4 more
#VU8576 - Improper input validation CVE-2016-6317	CWE-20	Low	No	No	4.2.3-6.fc23, 4.2.5.2-3.fc24, 5.0.0.1-2.fc25	14.09.2016	SB2016012701 SB2016081711 SB2016081902 and 1 more
#VU8567 - Improper Control of Generation of Code ('Code Injection') CVE-2016-2098	CWE-94	High	Available	No	4.2.0-4.fc22, 4.2.3-5.fc23	16.03.2016	SB2016031601 SB2016031003 SB2016032301 and 7 more
#VU8586 - Permissions, Privileges, and Access Controls CVE-2016-0753	CWE-264	Low	No	No	4.2.0-3.fc22	16.02.2016	SB2016012702 SB2016042501 SB2016013104 and 4 more
#VU8568 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2016-0752	CWE-22	Medium	Available	Exploited	4.2.0-3.fc22	16.02.2016	SB2016021701 SB2016031003 SB2016042501 and 3 more
#VU8579 - Covert Timing Channel CVE-2015-7576	CWE-385	Low	No	No	4.2.0-3.fc22, 4.2.3-4.fc23	26.01.2016	SB2016012702 SB2016042501 SB2016013103 and 3 more
#VU8584 - Improper input validation CVE-2015-7581	CWE-20	Low	No	No	4.2.0-3.fc22, 4.2.3-4.fc23	26.01.2016	SB2016012702 SB2016042501 SB2016013103 and 1 more