heartcombo records
3 published records for vendor heartcombo.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-312 Cleartext Storage of Sensitive Information1
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2015-8314No exploit | The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persisheartcombo · devise · CWE-312 | High7.5 | — | 0.6% | Dec 12, 2023 |
24Monitor | CVE-2026-32700No exploit | Devise has a confirmable "change email" race condition that permits user to confirm email they have no access toheartcombo · devise · CWE-362 | Medium6.0 | — | 0.2% | Mar 18, 2026 |
24Monitor | CVE-2026-40295No exploit | Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handlerheartcombo · devise · CWE-601 | Medium6.1 | — | 0.2% | May 22, 2026 |
- CVE-2015-831430Monitor
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persis
HighCVSS 7.5No exploitEPSS 0%heartcombo · deviseDec 12, 2023
- CVE-2026-3270024Monitor
Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to
MediumCVSS 6.0No exploitEPSS 0%heartcombo · deviseMar 18, 2026
- CVE-2026-4029524Monitor
Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler
MediumCVSS 6.1No exploitEPSS 0%heartcombo · deviseMay 22, 2026