{"items":[{"id":"CVE-2026-120716","published":"2026-11-03T20:40:53.643Z","updated":"2026-11-06T19:35:58.297Z","title":"Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-119636","published":"2026-11-03T20:39:03.640Z","updated":"2026-11-06T19:37:40.949Z","title":"Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-120734","published":"2026-11-03T20:37:06.764Z","updated":"2026-11-06T19:40:02.842Z","title":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-120715","published":"2026-11-03T20:34:30.203Z","updated":"2026-11-06T19:40:56.000Z","title":"Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-120733","published":"2026-11-03T20:32:35.256Z","updated":"2026-11-06T19:41:43.186Z","title":"Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-121580","published":"2026-11-03T20:28:01.804Z","updated":"2026-11-06T19:42:37.012Z","title":"Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-116627","published":"2026-10-27T12:45:34.223Z","updated":"2026-11-04T17:16:17.133Z","title":"Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0…","severity":"HIGH","score":8.7,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-114487","published":"2026-10-22T15:48:35.922Z","updated":"2026-10-30T19:33:39.484Z","title":"Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00198,"kevAdded":null},{"id":"CVE-2026-114486","published":"2026-10-22T15:38:55.177Z","updated":"2026-10-30T18:53:01.286Z","title":"Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-114485","published":"2026-10-22T15:37:16.071Z","updated":"2026-10-30T18:51:20.872Z","title":"Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00241,"kevAdded":null},{"id":"CVE-2026-110805","published":"2026-10-16T13:46:53.212Z","updated":"2026-10-16T15:08:11.754Z","title":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate…","severity":"LOW","score":2.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-110804","published":"2026-10-16T13:45:38.143Z","updated":"2026-10-16T15:08:54.643Z","title":"Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-110806","published":"2026-10-16T13:44:20.481Z","updated":"2026-10-16T15:09:31.579Z","title":"Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-110287","published":"2026-10-16T13:43:25.516Z","updated":"2026-10-16T15:10:08.692Z","title":"Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-105488","published":"2026-10-06T18:20:11.012Z","updated":"2026-10-07T15:17:37.723Z","title":"Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission…","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-105485","published":"2026-10-06T18:18:19.368Z","updated":"2026-10-06T19:00:19.392Z","title":"Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via…","severity":"MEDIUM","score":6.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-9226","published":"2026-10-06T18:17:01.861Z","updated":"2026-10-07T15:16:42.376Z","title":"Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account…","severity":"MEDIUM","score":6.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-100289","published":"2026-09-29T15:48:33.025Z","updated":"2026-09-29T16:39:49.511Z","title":"Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-100288","published":"2026-09-29T15:46:27.734Z","updated":"2026-09-30T20:11:09.001Z","title":"Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to…","severity":"HIGH","score":7.2,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00068,"kevAdded":null},{"id":"CVE-2026-100287","published":"2026-09-29T15:38:53.604Z","updated":"2026-09-29T16:40:39.457Z","title":"Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-100286","published":"2026-09-29T15:33:56.325Z","updated":"2026-09-29T16:41:18.693Z","title":"Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-93332","published":"2026-09-29T15:29:20.156Z","updated":"2026-09-30T20:11:09.869Z","title":"Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create,…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-93330","published":"2026-09-29T15:25:16.942Z","updated":"2026-09-29T15:40:51.204Z","title":"Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-92237","published":"2026-09-15T20:14:31.376Z","updated":"2026-09-16T17:50:21.780Z","title":"Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2026-13327","published":"2026-09-15T19:14:33.240Z","updated":"2026-09-20T00:38:38.621Z","title":"Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to…","severity":"HIGH","score":8.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-84850","published":"2026-09-15T19:11:12.745Z","updated":"2026-09-20T00:38:07.754Z","title":"Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a…","severity":"MEDIUM","score":4.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-90969","published":"2026-09-15T19:09:33.847Z","updated":"2026-09-20T00:37:24.991Z","title":"Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-90971","published":"2026-09-15T19:07:02.950Z","updated":"2026-09-20T00:36:28.495Z","title":"Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0034,"kevAdded":null},{"id":"CVE-2026-78417","published":"2026-08-24T18:26:25.739Z","updated":"2026-08-28T17:33:51.985Z","title":"Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier,…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-19768","published":"2026-08-14T13:48:03.607Z","updated":"2026-08-14T14:52:35.426Z","title":"Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-8497","published":"2026-07-29T17:24:59.168Z","updated":"2026-07-29T18:14:01.902Z","title":"Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS…","severity":"HIGH","score":7.4,"vendor":"Devolutions","product":"Password Manager","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-17570","published":"2026-07-27T17:38:05.237Z","updated":"2026-07-27T18:33:13.569Z","title":"Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-17569","published":"2026-07-27T17:37:19.772Z","updated":"2026-07-28T13:45:03.527Z","title":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-17568","published":"2026-07-27T17:36:57.462Z","updated":"2026-07-28T13:43:18.213Z","title":"Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-16802","published":"2026-07-24T14:55:56.419Z","updated":"2026-07-24T17:39:03.467Z","title":"Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00103,"kevAdded":null},{"id":"CVE-2026-16801","published":"2026-07-24T14:55:22.997Z","updated":"2026-07-24T17:40:50.106Z","title":"Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-16800","published":"2026-07-24T14:54:56.746Z","updated":"2026-07-24T17:43:24.583Z","title":"Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-16799","published":"2026-07-24T14:53:33.439Z","updated":"2026-07-24T17:47:16.710Z","title":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-16798","published":"2026-07-24T14:53:01.692Z","updated":"2026-07-24T17:49:40.208Z","title":"Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-15058","published":"2026-07-14T18:11:10.858Z","updated":"2026-07-15T14:46:13.929Z","title":"Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another…","severity":"LOW","score":3.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-15642","published":"2026-07-14T18:09:46.308Z","updated":"2026-07-15T14:43:07.544Z","title":"Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an…","severity":"LOW","score":3.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-15641","published":"2026-07-14T18:09:00.784Z","updated":"2026-07-15T14:41:44.756Z","title":"Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve…","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-15637","published":"2026-07-14T18:05:34.963Z","updated":"2026-07-15T14:40:46.594Z","title":"Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-14536","published":"2026-07-06T19:23:21.459Z","updated":"2026-07-09T15:01:21.700Z","title":"Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to…","severity":"HIGH","score":7.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-13437","published":"2026-06-29T15:23:53.472Z","updated":"2026-06-29T16:25:22.355Z","title":"Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-13372","published":"2026-06-26T18:22:02.763Z","updated":"2026-06-26T19:25:32.593Z","title":"Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an…","severity":"HIGH","score":7.2,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-12755","published":"2026-06-25T13:12:54.439Z","updated":"2026-06-25T14:52:29.837Z","title":"Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the…","severity":"LOW","score":2.7,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-10696","published":"2026-06-17T18:43:29.276Z","updated":"2026-06-17T19:39:32.170Z","title":"Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"UniGetUI","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-12105","published":"2026-06-16T18:28:04.584Z","updated":"2026-06-17T15:15:42.158Z","title":"Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-12117","published":"2026-06-16T18:25:19.018Z","updated":"2026-06-17T15:14:46.588Z","title":"Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-11890","published":"2026-06-16T18:24:00.306Z","updated":"2026-06-17T15:13:34.386Z","title":"Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-12162","published":"2026-06-15T23:56:59.391Z","updated":"2026-06-16T12:51:25.016Z","title":"Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login…","severity":"MEDIUM","score":5.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-12161","published":"2026-06-15T23:55:24.745Z","updated":"2026-07-20T14:08:43.120Z","title":"Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-8694","published":"2026-06-12T14:11:33.453Z","updated":"2026-06-12T15:17:07.858Z","title":"Improper access control on the API documentation endpoint in PowerShell Universal","severity":"MEDIUM","score":5.3,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-10544","published":"2026-06-08T18:26:45.610Z","updated":"2026-06-08T19:53:47.082Z","title":"Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-10787","published":"2026-06-08T18:26:25.970Z","updated":"2026-06-09T14:36:50.004Z","title":"Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-10786","published":"2026-06-08T18:26:09.352Z","updated":"2026-06-08T19:44:31.961Z","title":"Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2026-9522","published":"2026-06-02T14:08:07.964Z","updated":"2026-06-02T19:37:10.123Z","title":"Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-9590","published":"2026-06-02T14:07:08.599Z","updated":"2026-06-02T19:39:51.159Z","title":"Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit…","severity":"MEDIUM","score":5.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-7325","published":"2026-05-22T15:30:08.167Z","updated":"2026-05-22T16:48:37.785Z","title":"Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication…","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-9251","published":"2026-05-22T15:29:25.378Z","updated":"2026-05-22T16:49:29.562Z","title":"Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-5171","published":"2026-05-22T15:28:47.611Z","updated":"2026-05-22T16:50:52.887Z","title":"Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-8477","published":"2026-05-22T15:27:34.768Z","updated":"2026-05-22T16:51:48.017Z","title":"Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access…","severity":"LOW","score":2.7,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-9246","published":"2026-05-22T15:26:51.049Z","updated":"2026-05-22T16:52:43.390Z","title":"Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-9224","published":"2026-05-22T15:25:33.660Z","updated":"2026-05-22T16:53:32.882Z","title":"Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-9249","published":"2026-05-22T15:24:48.376Z","updated":"2026-05-22T16:54:12.579Z","title":"Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password…","severity":"LOW","score":3.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-9245","published":"2026-05-22T15:24:09.107Z","updated":"2026-05-22T16:54:56.535Z","title":"Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-9247","published":"2026-05-22T15:23:12.259Z","updated":"2026-05-22T16:55:53.773Z","title":"Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without…","severity":"LOW","score":2.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-9248","published":"2026-05-22T15:22:31.843Z","updated":"2026-05-22T16:56:44.768Z","title":"Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation…","severity":"LOW","score":2.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-9223","published":"2026-05-22T15:21:39.170Z","updated":"2026-05-22T16:57:45.787Z","title":"Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-9047","published":"2026-05-22T15:18:39.966Z","updated":"2026-05-22T16:58:40.924Z","title":"Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's…","severity":"HIGH","score":7.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-5146","published":"2026-05-12T17:28:21.264Z","updated":"2026-05-13T16:01:19.326Z","title":"Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-8407","published":"2026-05-12T16:16:50.924Z","updated":"2026-05-13T16:00:40.920Z","title":"Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00197,"kevAdded":null},{"id":"CVE-2026-6706","published":"2026-04-28T13:11:44.350Z","updated":"2026-04-30T17:39:14.209Z","title":"Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-4989","published":"2026-04-01T15:07:29.219Z","updated":"2026-04-01T17:15:10.559Z","title":"Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00168,"kevAdded":null},{"id":"CVE-2026-5175","published":"2026-04-01T15:04:22.130Z","updated":"2026-04-01T20:12:09.411Z","title":"Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-4925","published":"2026-04-01T15:02:06.733Z","updated":"2026-04-01T20:16:31.765Z","title":"Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-4927","published":"2026-04-01T14:54:45.806Z","updated":"2026-04-01T19:26:56.487Z","title":"Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-4924","published":"2026-04-01T14:50:51.684Z","updated":"2026-04-01T20:19:57.967Z","title":"Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid…","severity":"HIGH","score":8.2,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-4828","published":"2026-04-01T14:48:53.684Z","updated":"2026-04-01T20:23:02.072Z","title":"Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass…","severity":"HIGH","score":8.2,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-4829","published":"2026-04-01T14:44:05.292Z","updated":"2026-04-01T19:25:17.305Z","title":"Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2026-4434","published":"2026-03-20T12:52:55.762Z","updated":"2026-03-23T14:12:02.673Z","title":"Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00147,"kevAdded":null},{"id":"CVE-2026-4396","published":"2026-03-18T19:41:34.801Z","updated":"2026-03-18T20:10:58.385Z","title":"Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via…","severity":"HIGH","score":8.3,"vendor":"Devolutions","product":"Hub Reporting Service","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2026-3563","published":"2026-03-17T19:15:37.820Z","updated":"2026-03-17T20:04:00.419Z","title":"Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to…","severity":"MEDIUM","score":5.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-4064","published":"2026-03-17T19:14:17.189Z","updated":"2026-03-17T20:03:19.106Z","title":"Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to…","severity":"HIGH","score":8.3,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-3638","published":"2026-03-09T18:51:13.485Z","updated":"2026-03-09T19:31:20.567Z","title":"Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to…","severity":"MEDIUM","score":5.9,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-3130","published":"2026-03-03T21:27:38.891Z","updated":"2026-03-04T14:45:47.873Z","title":"Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2026-3204","published":"2026-03-03T21:24:30.044Z","updated":"2026-03-04T16:36:47.100Z","title":"Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-2590","published":"2026-03-03T21:22:34.114Z","updated":"2026-05-10T12:55:59.865Z","title":"Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-3224","published":"2026-03-03T21:21:27.611Z","updated":"2026-03-04T14:43:18.563Z","title":"Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2026-3277","published":"2026-02-27T15:11:18.252Z","updated":"2026-03-30T20:43:33.695Z","title":"The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the…","severity":"MEDIUM","score":5.5,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-3221","published":"2026-02-25T18:29:11.939Z","updated":"2026-02-26T16:03:04.217Z","title":"Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the…","severity":"MEDIUM","score":4.9,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-3131","published":"2026-02-24T19:01:29.096Z","updated":"2026-02-26T16:09:13.047Z","title":"Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-1768","published":"2026-02-24T19:01:07.640Z","updated":"2026-02-26T16:12:31.144Z","title":"A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-1007","published":"2026-01-19T14:32:06.163Z","updated":"2026-01-20T15:02:33.576Z","title":"Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server:…","severity":"HIGH","score":7.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-0610","published":"2026-01-19T14:31:13.173Z","updated":"2026-01-20T15:05:32.415Z","title":"SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00309,"kevAdded":null},{"id":"CVE-2026-0747","published":"2026-01-08T19:55:58.944Z","updated":"2026-01-08T20:07:40.198Z","title":"Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows…","severity":"LOW","score":3.3,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-0618","published":"2026-01-07T17:00:21.027Z","updated":"2026-01-07T17:21:44.829Z","title":"Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.","severity":"MEDIUM","score":6.1,"vendor":"Devolutions","product":"PowerShell Universal","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2025-13683","published":"2025-11-28T17:00:48.552Z","updated":"2025-11-28T18:35:01.072Z","title":"Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2025-13758","published":"2025-11-27T15:30:47.944Z","updated":"2025-12-01T19:15:26.642Z","title":"Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.","severity":"LOW","score":3.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-13757","published":"2025-11-27T15:30:30.532Z","updated":"2025-12-01T19:15:31.878Z","title":"SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2025-13765","published":"2025-11-27T15:30:13.028Z","updated":"2025-12-01T19:15:37.321Z","title":"Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21,…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-12485","published":"2025-11-06T16:37:14.546Z","updated":"2025-11-07T14:07:04.358Z","title":"Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2025-12808","published":"2025-11-06T16:36:14.506Z","updated":"2025-11-07T14:06:55.095Z","title":"Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2025-11957","published":"2025-10-22T17:09:15.684Z","updated":"2025-11-25T17:25:37.093Z","title":"Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or…","severity":"CRITICAL","score":9,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-11958","published":"2025-10-22T17:08:29.440Z","updated":"2025-11-27T15:41:00.993Z","title":"An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a…","severity":"MEDIUM","score":5.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-11619","published":"2025-10-15T19:45:10.912Z","updated":"2025-10-15T20:01:15.384Z","title":"Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2025-8312","published":"2025-07-30T16:10:05.322Z","updated":"2025-08-19T12:18:26.409Z","title":"Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a…","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2025-8353","published":"2025-07-30T16:06:46.196Z","updated":"2025-07-30T16:17:38.655Z","title":"UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated…","severity":"MEDIUM","score":5.9,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2025-6741","published":"2025-07-22T17:00:15.146Z","updated":"2025-11-25T17:24:25.958Z","title":"Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message…","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2025-6523","published":"2025-07-22T17:00:10.697Z","updated":"2025-11-25T17:23:40.966Z","title":"Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute…","severity":"CRITICAL","score":9.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2025-0691","published":"2025-06-05T13:41:42.695Z","updated":"2025-06-05T14:06:43.685Z","title":"Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the \"Edit permission\"…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2025-5382","published":"2025-06-05T13:37:05.463Z","updated":"2025-06-05T13:58:59.736Z","title":"Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change…","severity":"MEDIUM","score":6.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-3768","published":"2025-06-05T13:36:41.991Z","updated":"2025-06-05T14:09:18.593Z","title":"Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking…","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2025-4433","published":"2025-05-30T12:16:03.245Z","updated":"2025-11-25T17:21:58.188Z","title":"Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both \"User Management\" and…","severity":"HIGH","score":8.7,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2025-5334","published":"2025-05-29T14:47:25.817Z","updated":"2025-06-10T18:24:21.477Z","title":"Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-4493","published":"2025-05-28T12:35:36.654Z","updated":"2025-05-28T14:01:58.786Z","title":"Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2025-4316","published":"2025-05-05T14:00:50.110Z","updated":"2025-05-14T12:32:48.526Z","title":"Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2025-3517","published":"2025-05-01T18:26:22.565Z","updated":"2025-05-02T12:21:00.974Z","title":"Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured…","severity":"MEDIUM","score":6.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2025-2600","published":"2025-03-26T17:37:39.621Z","updated":"2025-08-26T17:43:23.847Z","title":"Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD…","severity":"MEDIUM","score":6.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2025-2562","published":"2025-03-26T17:24:37.280Z","updated":"2025-03-26T18:18:25.425Z","title":"Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-2528","published":"2025-03-26T17:20:00.521Z","updated":"2025-03-26T18:55:36.027Z","title":"Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration…","severity":"LOW","score":3.6,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2025-2499","published":"2025-03-26T17:14:59.457Z","updated":"2025-03-26T19:31:19.517Z","title":"Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2025-2280","published":"2025-03-13T13:02:47.702Z","updated":"2025-03-19T13:22:55.007Z","title":"Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-2278","published":"2025-03-13T12:56:04.995Z","updated":"2025-03-18T16:18:46.095Z","title":"Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2025-1636","published":"2025-03-13T12:47:13.034Z","updated":"2025-03-18T16:20:55.598Z","title":"Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.01757,"kevAdded":null},{"id":"CVE-2025-1635","published":"2025-03-13T12:47:06.016Z","updated":"2025-03-18T16:30:09.958Z","title":"Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.01757,"kevAdded":null},{"id":"CVE-2025-2277","published":"2025-03-13T12:47:02.631Z","updated":"2025-03-18T16:30:53.932Z","title":"Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00558,"kevAdded":null},{"id":"CVE-2025-2003","published":"2025-03-05T18:56:20.360Z","updated":"2025-03-05T19:23:25.474Z","title":"Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.","severity":"HIGH","score":7.1,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2025-1231","published":"2025-02-11T14:05:38.399Z","updated":"2025-02-11T14:56:16.812Z","title":"Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2024-11621","published":"2025-02-10T13:55:29.155Z","updated":"2025-02-12T15:17:11.387Z","title":"Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2025-1193","published":"2025-02-10T13:55:24.826Z","updated":"2025-02-10T17:12:19.712Z","title":"Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2024-12148","published":"2024-12-04T17:18:21.584Z","updated":"2024-12-05T18:45:02.579Z","title":"Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2024-12149","published":"2024-12-04T17:18:01.565Z","updated":"2024-12-05T18:46:29.926Z","title":"Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an…","severity":"HIGH","score":8.1,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2024-12151","published":"2024-12-04T17:17:31.712Z","updated":"2024-12-05T18:48:20.286Z","title":"Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.","severity":"MEDIUM","score":5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2024-12196","published":"2024-12-04T17:17:06.238Z","updated":"2024-12-04T21:13:37.434Z","title":"Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2024-11862","published":"2024-11-27T14:35:01.734Z","updated":"2024-11-27T14:53:57.448Z","title":"Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a…","severity":"MEDIUM","score":5.1,"vendor":"Devolutions","product":"XTS.NET","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2024-11670","published":"2024-11-25T14:46:58.455Z","updated":"2024-11-25T15:50:11.300Z","title":"Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00666,"kevAdded":null},{"id":"CVE-2024-11671","published":"2024-11-25T14:46:42.687Z","updated":"2024-11-25T16:47:10.705Z","title":"Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2024-11672","published":"2024-11-25T14:46:20.186Z","updated":"2024-11-25T16:47:53.171Z","title":"Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2024-10971","published":"2024-11-12T15:52:14.839Z","updated":"2024-11-20T22:39:24.048Z","title":"Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"DVLS (Devolutions Server)","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2024-7421","published":"2024-09-25T15:12:54.854Z","updated":"2025-03-17T14:10:14.983Z","title":"An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain…","severity":"MEDIUM","score":5.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00152,"kevAdded":null},{"id":"CVE-2024-6512","published":"2024-09-25T13:55:28.818Z","updated":"2025-03-14T15:49:24.390Z","title":"Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2024-6492","published":"2024-07-16T18:16:36.780Z","updated":"2024-11-05T21:53:35.800Z","title":"Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an…","severity":"HIGH","score":7.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00599,"kevAdded":null},{"id":"CVE-2024-6354","published":"2024-06-26T16:20:42.264Z","updated":"2025-03-13T18:28:31.840Z","title":"Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the…","severity":"HIGH","score":7.2,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00786,"kevAdded":null},{"id":"CVE-2024-4846","published":"2024-06-25T12:18:18.180Z","updated":"2024-11-20T21:35:56.186Z","title":"Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without…","severity":"MEDIUM","score":6.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2024-6057","published":"2024-06-17T13:10:42.462Z","updated":"2024-08-29T20:09:51.084Z","title":"Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00921,"kevAdded":null},{"id":"CVE-2024-6055","published":"2024-06-17T12:55:28.759Z","updated":"2024-10-30T19:14:03.801Z","title":"Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an…","severity":"MEDIUM","score":4.7,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2024-5072","published":"2024-05-17T15:18:15.722Z","updated":"2025-03-13T16:45:40.484Z","title":"Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2024-3545","published":"2024-04-09T19:01:43.329Z","updated":"2024-11-04T16:46:03.419Z","title":"Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2024-2918","published":"2024-04-09T18:42:44.643Z","updated":"2024-11-06T23:17:32.514Z","title":"Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation…","severity":"LOW","score":3.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2024-2921","published":"2024-03-26T15:51:24.128Z","updated":"2024-11-07T15:30:21.748Z","title":"Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2024-2915","published":"2024-03-26T15:51:02.451Z","updated":"2024-10-28T18:32:24.481Z","title":"Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00647,"kevAdded":null},{"id":"CVE-2024-2403","published":"2024-03-13T18:05:18.218Z","updated":"2025-03-26T20:10:07.560Z","title":"Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that…","severity":"MEDIUM","score":5.9,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2024-2241","published":"2024-03-07T13:11:22.338Z","updated":"2024-10-30T17:53:38.772Z","title":"Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via…","severity":"MEDIUM","score":6.3,"vendor":"Devolutions","product":"Workspace","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2024-1764","published":"2024-03-05T21:35:52.233Z","updated":"2024-12-04T15:42:58.365Z","title":"Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated…","severity":"HIGH","score":7.6,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2024-1898","published":"2024-03-05T21:35:04.786Z","updated":"2025-03-14T00:30:07.216Z","title":"Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings…","severity":"LOW","score":3.9,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2024-1900","published":"2024-03-05T21:34:13.992Z","updated":"2024-11-01T17:03:37.256Z","title":"Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an…","severity":"MEDIUM","score":5.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2024-1901","published":"2024-03-05T21:33:18.547Z","updated":"2024-11-06T14:24:05.805Z","title":"Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2024-0589","published":"2024-01-31T13:04:51.170Z","updated":"2025-06-09T18:12:42.643Z","title":"Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows allows an attacker…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2023-7047","published":"2023-12-21T14:42:58.084Z","updated":"2024-10-29T16:29:32.671Z","title":"Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31…","severity":"MEDIUM","score":4.4,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2023-6593","published":"2023-12-12T14:32:56.806Z","updated":"2024-08-28T14:52:06.753Z","title":"Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00725,"kevAdded":null},{"id":"CVE-2023-6588","published":"2023-12-07T15:59:19.821Z","updated":"2024-08-02T08:35:14.826Z","title":"Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Workspace","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2023-6288","published":"2023-12-06T13:49:50.204Z","updated":"2024-08-02T08:28:20.356Z","title":"Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable.","severity":"HIGH","score":7.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2023-6264","published":"2023-11-22T18:39:21.629Z","updated":"2024-08-02T08:28:20.199Z","title":"Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions…","severity":"MEDIUM","score":5.3,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2023-5358","published":"2023-11-01T17:17:31.501Z","updated":"2024-09-06T18:40:19.905Z","title":"Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries…","severity":"MEDIUM","score":5.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2023-5765","published":"2023-11-01T17:12:15.912Z","updated":"2024-09-06T15:47:08.487Z","title":"Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2023-5766","published":"2023-11-01T17:08:03.162Z","updated":"2024-09-06T18:45:42.992Z","title":"A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00713,"kevAdded":null},{"id":"CVE-2023-5575","published":"2023-10-16T13:29:57.988Z","updated":"2024-09-16T18:08:03.213Z","title":"Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00771,"kevAdded":null},{"id":"CVE-2023-5240","published":"2023-10-13T12:22:23.816Z","updated":"2024-09-17T20:28:22.828Z","title":"Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00747,"kevAdded":null},{"id":"CVE-2023-4417","published":"2023-08-21T18:38:06.606Z","updated":"2024-10-04T16:50:38.460Z","title":"Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2023-4373","published":"2023-08-21T18:36:23.305Z","updated":"2024-10-03T17:54:55.052Z","title":"Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a…","severity":"CRITICAL","score":9.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00718,"kevAdded":null},{"id":"CVE-2023-2400","published":"2023-06-20T16:19:50.629Z","updated":"2024-12-09T18:29:48.495Z","title":"Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted…","severity":"LOW","score":2.7,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2023-2445","published":"2023-05-02T13:11:06.405Z","updated":"2025-01-30T16:10:20.896Z","title":"Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to…","severity":"MEDIUM","score":4.9,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00979,"kevAdded":null},{"id":"CVE-2023-2282","published":"2023-04-25T18:23:00.287Z","updated":"2025-02-04T14:25:24.760Z","title":"Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticated user to bypass…","severity":"LOW","score":3.1,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2023-2257","published":"2023-04-24T18:48:52.039Z","updated":"2025-02-04T16:02:43.531Z","title":"Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access…","severity":"MEDIUM","score":6.1,"vendor":"Devolutions","product":"Workspace Desktop","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2023-2118","published":"2023-04-21T21:52:14.163Z","updated":"2025-02-04T19:54:58.711Z","title":"Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and…","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2023-1939","published":"2023-04-11T17:47:49.976Z","updated":"2025-02-10T18:57:15.161Z","title":"No access control for the OTP key on OTP entries","severity":"MEDIUM","score":4.3,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2023-1980","published":"2023-04-11T17:44:15.373Z","updated":"2025-02-10T19:01:09.998Z","title":"Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2023-1603","published":"2023-03-23T17:13:31.049Z","updated":"2025-02-25T17:14:37.879Z","title":"Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Server","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2023-1202","published":"2023-03-23T17:12:47.824Z","updated":"2025-02-20T20:54:27.768Z","title":"Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2023-1580","published":"2023-03-22T17:49:11.291Z","updated":"2025-02-25T20:54:41.619Z","title":"Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of service by filling…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Gateway","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2023-1574","published":"2023-03-22T12:50:16.949Z","updated":"2025-02-25T20:56:29.119Z","title":"Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2023-1201","published":"2023-03-06T17:15:00.735Z","updated":"2025-03-06T14:53:59.575Z","title":"Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2023-1203","published":"2023-03-06T16:38:52.008Z","updated":"2025-03-06T14:55:36.915Z","title":"Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager PowerShell Module","kev":false,"epss":0.01056,"kevAdded":null},{"id":"CVE-2023-0952","published":"2023-02-22T13:51:39.898Z","updated":"2025-03-17T18:28:29.860Z","title":"Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2023-0951","published":"2023-02-22T13:46:30.884Z","updated":"2025-03-17T18:27:58.139Z","title":"Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actions.","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.00997,"kevAdded":null},{"id":"CVE-2023-0953","published":"2023-02-22T13:42:04.305Z","updated":"2025-03-12T13:55:52.607Z","title":"Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.01032,"kevAdded":null},{"id":"CVE-2023-0661","published":"2023-02-03T15:48:17.672Z","updated":"2025-03-25T20:45:31.167Z","title":"Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2023-0463","published":"2023-01-24T16:42:58.172Z","updated":"2025-04-02T13:33:28.957Z","title":"The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user…","severity":"HIGH","score":7.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2022-4287","published":"2022-12-20T14:16:09.540Z","updated":"2025-04-14T18:15:14.991Z","title":"Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.01088,"kevAdded":null},{"id":"CVE-2022-3641","published":"2022-12-07T14:35:18.529Z","updated":"2025-04-23T13:43:54.866Z","title":"Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2022-3781","published":"2022-11-01T18:28:28.590Z","updated":"2025-05-05T14:04:03.985Z","title":"Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2022-3780","published":"2022-11-01T18:22:29.174Z","updated":"2025-05-05T14:06:40.669Z","title":"Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access…","severity":"HIGH","score":7.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2022-3182","published":"2022-09-13T19:27:28.000Z","updated":"2024-08-03T01:00:10.542Z","title":"Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the…","severity":"HIGH","score":7,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00161,"kevAdded":null},{"id":"CVE-2022-2316","published":"2022-07-06T18:56:20.000Z","updated":"2024-08-03T00:32:09.493Z","title":"HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to…","severity":"MEDIUM","score":5.4,"vendor":"Devolutions","product":"Devolutions Server","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2022-2221","published":"2022-06-27T18:38:57.000Z","updated":"2024-08-03T00:32:08.840Z","title":"Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access…","severity":"MEDIUM","score":6.5,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.01343,"kevAdded":null},{"id":"CVE-2022-1342","published":"2022-06-15T16:09:30.876Z","updated":"2024-09-17T03:55:09.040Z","title":"A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause…","severity":"MEDIUM","score":4.6,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2021-42098","published":"2021-10-18T13:22:57.000Z","updated":"2024-08-04T03:22:25.977Z","title":"An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom…","severity":"HIGH","score":8.8,"vendor":"Devolutions","product":"Remote Desktop Manager","kev":false,"epss":0.01757,"kevAdded":null}]}