CVE-2026-40295

Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureAppredirecturl method returns request.referrer — the HTTP Referer header, which is attacker-controllable — without validation for any non-GET...

Frequency Diverse (FD)-RIS-Enhanced Covert Communications: Defense against Wiretapping Via Joint Distance-Angle Beamforming

In response to the security blind zone challenges faced by traditional reconfigurable intelligent surface RIS-aided covert communication CC systems, the joint distance-angle beamforming capability of frequency diverse RIS FD-RIS shows significant potential for addressing these limitations...

Simultaneously Exposing and Jamming Covert Communications Via Disco Reconfigurable Intelligent Surfaces

Covert communications provide a stronger privacy protection than cryptography and physical-layer security PLS. However, previous works on covert communications have implicitly assumed the validity of channel reciprocity, i.e., wireless channels remain constant or approximately constant during the...

M-10 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem There was unsafe cast in the getTier function and warden has stated, that in case if value will be bigger than uint96.max, then wrong prize amount will be used. Solution Pool together has increased Tier.prizeSize variable t...

Reuse of previous voting difference in extendPledge() charges too much fees

Lines of code Vulnerability details Description In Warden Pledge, creators can extend the life span of an existing pledge using extendPledge. Here's the implementation: uint256 addedDuration = newEndTimestamp - oldEndTimestamp; ifaddedDuration maxTotalRewardAmount revert...

Validate input variables bounds

83 comment Warden: throttle fee variables bounds are not checked. this can lead to expensive mistake --- The text was updated successfully, but these errors were encountered: All reactions...

Plataformatec Devise Authorization Issues Vulnerability

Plataformatec Devise is a Warden-based Rails authentication solution from Plataformatec, Brazil. An authorization issue vulnerability exists in Plataformatec Devise versions prior to 4.7.1. No detailed vulnerability details are provided at this time...

Unfixed XSS vulnerability at www.warden.wednet.edu

Security researcher lljkrieg, has submitted on 24/07/2009 a cross-site-scripting XSS vulnerability affecting www.warden.wednet.edu, which at the time of submission ranked 22970 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/06/2010. It is...