Heartcombo / Devise

3 CVEs

CVE ID	Description	Severity	CVSS	Published
CVE-2026-40295	Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler	MEDIUM	6.1	May 22, 2026
CVE-2026-32700	Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to	MEDIUM	6.0	Mar 18, 2026
CVE-2015-8314	The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application ac…	HIGH	7.5	Dec 12, 2023

Rows per page

Showing 1 to 3 of 3 CVEs