Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

devise

6 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 high, 2 medium
Registry
RubyGems

Advisories 6

  • CVE-2026-40295Medium 6.1

    Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

    Affected: fixed in 5.0.4.

  • CVE-2026-32700Medium 6.0

    Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to

    Affected: fixed in 5.0.3.

  • The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized…

    Affected: fixed in 3.5.4.

  • An issue was discovered in Plataformatec Devise before 4.7.1.

    Affected: fixed in 4.7.1.

  • Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The…

    Affected: fixed in 4.6.0.

  • Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does…

    Affected: from 2.2.0, fixed in 2.2.3; from 2.1.0, fixed in 2.1.3; from 2.0.0, fixed in 2.0.5; from 1.5.0, fixed in 1.5.4.