DE
Vendor
Devolutions
250
CVEs
0
On KEV
21
New 30D
Products
SE8.8
Server
Devolutions
58 CVEs0 on KEV16 new
DS9.8
Devolutions Server
Devolutions
116 CVEs0 on KEV4 new
PU8.8
PowerShell Universal
Devolutions
12 CVEs0 on KEV1 new
RD9.8
Remote Desktop Manager
Devolutions
54 CVEs0 on KEV0 new
WO7.8
Workspace
Devolutions
3 CVEs0 on KEV0 new
DG7.5
Devolutions Gateway
Devolutions
1 CVEs0 on KEV0 new
GF7.0
Gfwx
Devolutions
1 CVEs0 on KEV0 new
HR8.1
Hub Reporting Service
Devolutions
1 CVEs0 on KEV0 new
PH6.6
Password Hub
Devolutions
1 CVEs0 on KEV0 new
PM7.4
Password Manager
Devolutions
1 CVEs0 on KEV0 new
RD8.8
Remote Desktop Manager Powershell
Devolutions
1 CVEs0 on KEV0 new
UN7.5
UniGetUI
Devolutions
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116627 New | PU PowerShell Universal Devolutions | – | Oct 27 | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows… |
| CVE-2026-114487 New | SE Server Devolutions | – | Oct 22 | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated… |
| CVE-2026-114486 New | SE Server Devolutions | – | Oct 22 | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass… |
| CVE-2026-114485 New | SE Server Devolutions | – | Oct 22 | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view… |
| CVE-2026-110805 | SE Server Devolutions | 2.6 | Oct 16 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne… |
| CVE-2026-110804 | SE Server Devolutions | 4.3 | Oct 16 | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to… |
| CVE-2026-110806 | SE Server Devolutions | 6.5 | Oct 16 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the… |
| CVE-2026-110287 | SE Server Devolutions | 4.3 | Oct 16 | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to… |
| CVE-2026-105488 | SE Server Devolutions | 7.1 | Oct 6 | Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete… |
| CVE-2026-105485 | SE Server Devolutions | 6.8 | Oct 6 | Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured… |
| CVE-2026-9226 | SE Server Devolutions | 6.8 | Oct 6 | Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a… |
| CVE-2026-100289 | SE Server Devolutions | 5.0 | Sep 29 | Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan… |
| CVE-2026-100288 | SE Server Devolutions | 7.2 | Sep 29 | Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external… |
| CVE-2026-100287 | SE Server Devolutions | 5.4 | Sep 29 | Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault… |
| CVE-2026-100286 | SE Server Devolutions | 6.5 | Sep 29 | Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets… |
| CVE-2026-93332 | SE Server Devolutions | 5.4 | Sep 29 | Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete… |
| CVE-2026-93330 | SE Server Devolutions | 4.3 | Sep 29 | Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host… |
| CVE-2026-92237 | PU PowerShell Universal Devolutions | 6.5 | Sep 15 | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log… |
| CVE-2026-13327 | SE Server Devolutions | 8.3 | Sep 15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged… |
| CVE-2026-84850 | SE Server Devolutions | 4.8 | Sep 15 | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned… |
| CVE-2026-90969 | SE Server Devolutions | 6.5 | Sep 15 | Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain… |
| CVE-2026-90971 | SE Server Devolutions | 6.5 | Sep 15 | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other… |
| CVE-2026-78417 | RD Remote Desktop Manager Devolutions | 4.3 | Aug 24 | Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path… |
| CVE-2026-19768 | PU PowerShell Universal Devolutions | 8.1 | Aug 14 | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with… |
| CVE-2026-8497 | PM Password Manager Devolutions | 7.4 | Jul 29 | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an… |
| CVE-2026-17570 | SE Server Devolutions | 4.3 | Jul 27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via… |
| CVE-2026-17569 | SE Server Devolutions | 4.3 | Jul 27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the… |
| CVE-2026-17568 | SE Server Devolutions | 8.8 | Jul 27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership… |
| CVE-2026-16802 | PU PowerShell Universal Devolutions | 6.5 | Jul 24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read… |
| CVE-2026-16801 | PU PowerShell Universal Devolutions | 8.8 | Jul 24 | Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with… |
| CVE-2026-16800 | PU PowerShell Universal Devolutions | 8.8 | Jul 24 | Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with… |
| CVE-2026-16799 | PU PowerShell Universal Devolutions | 5.0 | Jul 24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader… |
| CVE-2026-16798 | PU PowerShell Universal Devolutions | 6.5 | Jul 24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job… |
| CVE-2026-15058 | SE Server Devolutions | 3.1 | Jul 14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a… |
| CVE-2026-15642 | SE Server Devolutions | 3.3 | Jul 14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access… |
| CVE-2026-15641 | SE Server Devolutions | 7.1 | Jul 14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending… |
| CVE-2026-15637 | SE Server Devolutions | 7.5 | Jul 14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose… |
| CVE-2026-14536 | SE Server Devolutions | 8.8 | Jul 6 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required… |
| CVE-2026-13437 | PU PowerShell Universal Devolutions | 6.5 | Jun 29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to… |
| CVE-2026-13372 | RD Remote Desktop Manager Devolutions | 7.2 | Jun 26 | Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker… |
| CVE-2026-12755 | SE Server Devolutions | 2.7 | Jun 25 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission… |
| CVE-2026-10696 | UN UniGetUI Devolutions | 7.5 | Jun 17 | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an… |
| CVE-2026-12105 | DS Devolutions Server Devolutions | 6.5 | Jun 16 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions |
| CVE-2026-12117 | DS Devolutions Server Devolutions | 4.3 | Jun 16 | Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to… |
| CVE-2026-11890 | DS Devolutions Server Devolutions | 4.3 | Jun 16 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results |
| CVE-2026-12162 | RD Remote Desktop Manager Devolutions | 5.5 | Jun 15 | Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a… |
| CVE-2026-12161 | RD Remote Desktop Manager Devolutions | 8.8 | Jun 15 | Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a… |
| CVE-2026-8694 | PU PowerShell Universal Devolutions | 5.3 | Jun 12 | Improper access control on the API documentation endpoint in PowerShell Universal |
| CVE-2026-10544 | SE Server Devolutions | 6.5 | Jun 8 | Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a… |
| CVE-2026-10787 | SE Server Devolutions | 4.3 | Jun 8 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted… |
| CVE-2026-10786 | SE Server Devolutions | 6.5 | Jun 8 | Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured… |
| CVE-2026-9522 | SE Server Devolutions | 5.4 | Jun 2 | Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete… |
| CVE-2026-9590 | SE Server Devolutions | 5.3 | Jun 2 | Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset… |
| CVE-2026-7325 | SE Server Devolutions | 7.1 | May 22 | Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with… |
| CVE-2026-9251 | SE Server Devolutions | 5.4 | May 22 | Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending… |
| CVE-2026-5171 | SE Server Devolutions | 4.3 | May 22 | Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to… |
| CVE-2026-8477 | SE Server Devolutions | 2.7 | May 22 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to… |
| CVE-2026-9246 | SE Server Devolutions | 4.3 | May 22 | Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation… |
| CVE-2026-9224 | SE Server Devolutions | 4.3 | May 22 | Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted… |
| CVE-2026-9249 | SE Server Devolutions | 3.1 | May 22 | Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request |