PU
Product
PowerShell Universal
13
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 4Medium 8Low 0
Watch
Add PowerShell Universal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16801 | 8.8 | Jul 24 | Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with… Affected: before 2026.2.3 |
| CVE-2026-16800 | 8.8 | Jul 24 | Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with… Affected: before 2026.2.3 |
| CVE-2026-4064 | 8.3 | Mar 17 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based… Affected: 2026.1.0 before 2026.1.4 |
| CVE-2026-19768 | 8.1 | Aug 14 | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with… Affected: before 2026.2.4 |
| CVE-2026-92237 | 6.5 | Sep 15 | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log… Affected: through 2026.2.5 |
| CVE-2026-16802 | 6.5 | Jul 24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read… Affected: before 2026.2.3 |
| CVE-2026-16798 | 6.5 | Jul 24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job… Affected: before 2026.2.3 |
| CVE-2026-13437 | 6.5 | Jun 29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to… Affected: 2026.2.0 |
| CVE-2026-3277 | 6.5 | Feb 27 | The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1… Affected: before 2026.1.3 |
| CVE-2026-3563 | 5.5 | Mar 17 | Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or… Affected: 2026.1.0 before 2026.1.4 |
| CVE-2026-8694 | 5.3 | Jun 12 | Improper access control on the API documentation endpoint in PowerShell Universal Affected: through 2026.1.7 |
| CVE-2026-16799 | 5.0 | Jul 24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader… Affected: before 2026.2.3 |
| CVE-2026-116627 New | – | Oct 27 | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows… Affected: before 2026.3.1 |
Showing 13