Hheartcombo

Products

Exploited and recent CVEs

• CVE-2026-40295 Medium 6.1 Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler 0.2%
• CVE-2026-32700 Medium 6.0 Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to 0.3%