TI-2026-25192 CVE-2026-32700 · GHSA-57hq-95w6-v4fc
Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to
Priority MEDIUM 60
Devise is an authentication solution for Rails based on Warden.
heartcombo
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
heartcombo records in CISA KEVNo heartcombo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Devise · all components
TI-2015-06843 CVE-2015-8314 · GHSA-746g-3gfp-hfhw
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which…
Priority MEDIUM 40
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
TI-2026-29075 CVE-2026-40295 · GHSA-jp94-3292-c3xv
Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler
Priority LOW 27
Devise is an authentication solution for Rails based on Warden.