heartcombo devise
- CVE-2026-40295 Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler 0.2%
- CVE-2026-32700 Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to 0.3%