Is Ruby on Rails secure in 2026?

Ruby on Rails has a security score of 62/100 with 180 total CVEs on record, including 18 critical severity and 2 actively exploited (CISA KEV). Overall score: 64/100. Verdict: acceptable. Data from NVD/NIST, July 2026.

How many CVEs does Ruby on Rails have?

Ruby on Rails has 180 total CVEs in the NVD database as of July 2026. Of these, 18 are critical severity (CVSS 9.0+), 2 are confirmed actively exploited per CISA KEV, and 15 were disclosed in the past year. Average CVSS: 5.8.

What is Ruby on Rails's WebPulse score?

Ruby on Rails scores 64/100 on the WebPulse framework health index. This composite score covers 7 dimensions: security, performance, ecosystem health, AI-readiness (72/100), developer experience, market trajectory, and cost of ownership. Ruby on Rails scores 65/100. Verdict: Acceptable.

← All frameworks

Ruby on Rails

modern ruby · backend · since 2004

acceptable ↓ 2.3 pts vs last month Updated June 2026

Ruby on Rails scores 65/100. Verdict: Acceptable.

Dimension breakdown

Security

Performance

Ecosystem

Ai Readiness

Developer Experience

Market Trajectory

Cost Of Ownership

Security

180 total CVEs on record. 18 critical severity. 2 actively exploited (CISA KEV).

Total Cves 180

Critical Cves 18

Exploited Cves 2

Avg Cvss 5.8

Cves Last Year 15

Performance

Average performance. Room for optimization.

Ecosystem

56,000 GitHub stars. 4,900 contributors. 10 releases in the last year.

Stars 56,000

Contributors 4,900

Releases Last Year 10

Avg Issue Close Days 12

Ai Readiness

Good AI-readiness. Supports structured data output and API patterns. Suitable for the AI-first web with some configuration.

Structured Output 72

Api First 0.0

Headless Capable 1.0

Developer Experience

Strong developer experience. Good docs, modern tooling, active community.

Market Trajectory

Score 50

Market Share Pct 0.8

Cost Of Ownership

Moderate cost. Requires traditional server infrastructure.

Actively exploited vulnerabilities

Updated 2026-08-09

3 entries

3 confirmed vulnerabilities being actively exploited in real attacks right now. Source: CISA Known Exploited Vulnerabilities.

Latest entry: 2025-07-07

            Ruby on Rails scores 65/100 overall. Strongest dimension: ai readiness (72). Weakest: market trajectory (50).
        

Compare Ruby on Rails

vs WordPress vs Next.js vs Drupal vs React vs Angular vs Django vs Laravel vs Vue.js vs Astro vs Hugo vs SvelteKit

Latest Ruby on Rails insights

The AI-First Web

Japan at 127K: HTMX Confirmed at 1,672 Sites. The Anti-Framework Found Its Culture.

June 2026 · 4 min

Innovation & Growth

.gg Is 75% Modern. Nuxt.js Leads at 33%. The Gaming Community Built Different.

June 2026 · 4 min

Innovation & Growth

Hong Kong Has the Most Diverse Web on Earth. Six Frameworks Above 5%.

June 2026 · 4 min

Security & Trust

.edu at 58,182 Detections: Drupal 35.7%, Rails 16.4%. Academia Fully Mapped.

June 2026 · 4 min

Security & Trust

.gov Is 49% Drupal. Government's Framework Choice Confirmed at 12,467 Sites.

June 2026 · 4 min

Security & Trust

.edu Domains Chose Differently: Drupal 35.7%, Rails 16.4%. Education Didn't Follow the WordPress Playbook.

May 2026 · 4 min

Ruby on Rails

Open-Source Guardrails Arrive for Agentic AI's Operational Risks

Universities Built for Browsers Are Invisible to AI. That Affects Enrollment.

Education Is the Slowest Sector to Modernize. It Has the Most to Lose.

Japan at 127K: HTMX Confirmed at 1,672 Sites. The Anti-Framework Found Its Culture.

.gg Is 75% Modern. Nuxt.js Leads at 33%. The Gaming Community Built Different.

Hong Kong Has the Most Diverse Web on Earth. Six Frameworks Above 5%.

.edu at 58,182 Detections: Drupal 35.7%, Rails 16.4%. Academia Fully Mapped.

.gov Is 49% Drupal. Government's Framework Choice Confirmed at 12,467 Sites.

.edu Domains Chose Differently: Drupal 35.7%, Rails 16.4%. Education Didn't Follow the WordPress Playbook.