CVE Program partner

DEVOLUTIONS

Devolutions Inc.

API
CVEs, 365 days96189 all time, 0 rejected
Quality65%median 99%
CVSS by the CNA2%share of records
CWE94%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA97%lower is better
OrganisationDevolutions Inc.
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeAll Devolutions products only.
Advisorieshttps://devolutions.net/security/advisories/

Latest CVEs · RSS

  • CVE-2026-110805 2026-10-16
    Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate th
  • CVE-2026-110804 2026-10-16
    Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM
  • CVE-2026-110806 2026-10-16
    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-o
  • CVE-2026-110287 2026-10-16
    Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit a
  • CVE-2026-105488 2026-10-06
    Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission t
  • CVE-2026-105485 2026-10-06
    Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via re
  • CVE-2026-9226 2026-10-06
    Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account vi
  • CVE-2026-100289 2026-09-29
    Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate
  • CVE-2026-100288 2026-09-29
    Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to o
  • CVE-2026-100287 2026-09-29
    Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently dele
  • CVE-2026-100286 2026-09-29
    Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose i
  • CVE-2026-93332 2026-09-29
    Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create,
  • CVE-2026-93330 2026-09-29
    Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions
  • CVE-2026-92237 2026-09-15
    Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authentica
  • CVE-2026-13327 2026-09-15
    Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to int
  • CVE-2026-84850 2026-09-15
    Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a
  • CVE-2026-90969 2026-09-15
    Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password pe
  • CVE-2026-90971 2026-09-15
    Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user
  • CVE-2026-78417 2026-08-24
    Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, all
  • CVE-2026-19768 2026-08-14
    Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticat
  • CVE-2026-8497 2026-07-29
    Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS
  • CVE-2026-17570 2026-07-27
    Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential
  • CVE-2026-17569 2026-07-27
    Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored A
  • CVE-2026-17568 2026-07-27
    Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group
  • CVE-2026-16802 2026-07-24
    Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file syst

All CVE Program partners