Ruby on Rails

Rails’ security advisory page lists every CVE the core team has disclosed, with affected version ranges, upgrade guidance, and links to patches. The record goes back far enough to function as a reference history of web-framework attack surfaces: mass assignment, YAML deserialisation as a remote-code-execution vector, SQL injection through scope construction, and timing attacks on authentication tokens all appear across the 2.x and 3.x era.

The page carries no formal severity scores beyond the core team’s prose assessment, and the release notes at guides.rubyonrails.org are a separate surface covering compatibility changes and deprecations rather than security detail. Together they form the practical upgrade record; neither alone is complete.