Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
128 results · page 1 of 3
Oct 22, 2026Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authentiCVE-2026-114487 · Other software · Devolutions · reported by security@devolutions.net
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative atCVE-2026-114486 · Other software · Devolutions · reported by security@devolutions.net
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with CVE-2026-114485 · Other software · Devolutions · reported by security@devolutions.net
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-oCVE-2026-110806 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate thCVE-2026-110805 · Other software · Devolutions · reported by security@devolutions.netLow 2.6
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM CVE-2026-110804 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit aCVE-2026-110287 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account viCVE-2026-9226 · Other software · Devolutions · reported by security@devolutions.netMedium 6.8
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission tCVE-2026-105488 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via reCVE-2026-105485 · Other software · Devolutions · reported by security@devolutions.netMedium 6.8
Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, CVE-2026-93332 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions CVE-2026-93330 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generateCVE-2026-100289 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to oCVE-2026-100288 · Other software · Devolutions · reported by security@devolutions.netHigh 7.2
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently deleCVE-2026-100287 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose iCVE-2026-100286 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intCVE-2026-13327 · Other software · Devolutions · reported by security@devolutions.netHigh 8.3
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user CVE-2026-90971 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password peCVE-2026-90969 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a CVE-2026-84850 · Other software · Devolutions · reported by security@devolutions.netMedium 4.8
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS CVE-2026-8497 · Other software · Devolutions · reported by security@devolutions.netHigh 7.4
Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.
- Product
- Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credentialCVE-2026-17570 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored ACVE-2026-17569 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group CVE-2026-17568 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attCVE-2026-15642 · Other software · Devolutions · reported by security@devolutions.netLow 3.3
Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve tCVE-2026-15641 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privilegeCVE-2026-15637 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user'sCVE-2026-15058 · Other software · Devolutions · reported by security@devolutions.netLow 3.1
Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypassCVE-2026-14536 · Other software · Devolutions · reported by security@devolutions.netHigh 8.8
Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGrouCVE-2026-12755 · Other software · Devolutions · reported by security@devolutions.netLow 2.7
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login CVE-2026-12117 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited perCVE-2026-12105 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery CVE-2026-11890 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.
- Product
- Devolutions Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groCVE-2026-10787 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials CVE-2026-10786 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with wriCVE-2026-10544 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privilegCVE-2026-9590 · Other software · Devolutions · reported by security@devolutions.netMedium 5.3
Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative priCVE-2026-9522 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enfCVE-2026-9251 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password changeCVE-2026-9249 · Other software · Devolutions · reported by security@devolutions.netLow 3.1
Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation anCVE-2026-9248 · Other software · Devolutions · reported by security@devolutions.netLow 2.6
Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triCVE-2026-9247 · Other software · Devolutions · reported by security@devolutions.netLow 2.4
Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieveCVE-2026-9246 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to anCVE-2026-9245 · Other software · Devolutions · reported by security@devolutions.netMedium 5
Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attribuCVE-2026-9224 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaultsCVE-2026-9223 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's CVE-2026-9047 · Other software · Devolutions · reported by security@devolutions.netHigh 7.6
Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access tCVE-2026-8477 · Other software · Devolutions · reported by security@devolutions.netLow 2.7
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication materiCVE-2026-7325 · Other software · Devolutions · reported by security@devolutions.netHigh 7.1
Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required peCVE-2026-5171 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.