https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-16676.htmlhttps://patchthecve.com/cve/CVE-2019-16676.htmlWed, 17 Jun 2026 02:22:33 +0000CRITICAL 9.8: Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.https://patchthecve.com/cve/CVE-2019-16109.htmlhttps://patchthecve.com/cve/CVE-2019-16109.htmlWed, 17 Jun 2026 02:21:41 +0000MEDIUM 5.3: An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records wouhttps://patchthecve.com/cve/CVE-2019-5421.htmlhttps://patchthecve.com/cve/CVE-2019-5421.htmlWed, 17 Jun 2026 02:37:39 +0000CRITICAL 9.8: Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent reques