# cve.now: Devolutions

The newest entries naming Devolutions as an affected vendor (up to 200), of 199 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120716](https://cve.now/CVE-2026-120716.md): Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and… (CVSS 6.5)
- [CVE-2026-119636](https://cve.now/CVE-2026-119636.md): Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through… (CVSS 8.8)
- [CVE-2026-120734](https://cve.now/CVE-2026-120734.md): Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an… (CVSS 6.5)
- [CVE-2026-120715](https://cve.now/CVE-2026-120715.md): Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an… (CVSS 8.1)
- [CVE-2026-120733](https://cve.now/CVE-2026-120733.md): Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with… (CVSS 7.5)
- [CVE-2026-121580](https://cve.now/CVE-2026-121580.md): Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated… (CVSS 8.1)
- [CVE-2026-116627](https://cve.now/CVE-2026-116627.md): Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions… (CVSS 8.7)
- [CVE-2026-114487](https://cve.now/CVE-2026-114487.md): Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and… (CVSS 4.3)
- [CVE-2026-114486](https://cve.now/CVE-2026-114486.md): Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated… (CVSS 4.3)
- [CVE-2026-114485](https://cve.now/CVE-2026-114485.md): Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an… (CVSS 4.3)
- [CVE-2026-110805](https://cve.now/CVE-2026-110805.md): Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged u (CVSS 2.6)
- [CVE-2026-110804](https://cve.now/CVE-2026-110804.md): Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenti (CVSS 4.3)
- [CVE-2026-110806](https://cve.now/CVE-2026-110806.md): Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permis (CVSS 6.5)
- [CVE-2026-110287](https://cve.now/CVE-2026-110287.md): Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edi (CVSS 4.3)
- [CVE-2026-105488](https://cve.now/CVE-2026-105488.md): Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vau (CVSS 7.1)
- [CVE-2026-105485](https://cve.now/CVE-2026-105485.md): Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a u (CVSS 6.8)
- [CVE-2026-9226](https://cve.now/CVE-2026-9226.md): Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over (CVSS 6.8)
- [CVE-2026-100289](https://cve.now/CVE-2026-100289.md): Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privile (CVSS 5.0)
- [CVE-2026-100288](https://cve.now/CVE-2026-100288.md): Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access (CVSS 7.2)
- [CVE-2026-100287](https://cve.now/CVE-2026-100287.md): Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user (CVSS 5.4)
- [CVE-2026-100286](https://cve.now/CVE-2026-100286.md): Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrativ (CVSS 6.5)
- [CVE-2026-93332](https://cve.now/CVE-2026-93332.md): Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged us (CVSS 5.4)
- [CVE-2026-93330](https://cve.now/CVE-2026-93330.md): Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to byp (CVSS 4.3)
- [CVE-2026-92237](https://cve.now/CVE-2026-92237.md): Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier (CVSS 6.5)
- [CVE-2026-13327](https://cve.now/CVE-2026-13327.md): Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positi (CVSS 8.3)
- [CVE-2026-84850](https://cve.now/CVE-2026-84850.md): Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 a (CVSS 4.8)
- [CVE-2026-90969](https://cve.now/CVE-2026-90969.md): Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking (CVSS 6.5)
- [CVE-2026-90971](https://cve.now/CVE-2026-90971.md): Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged (CVSS 6.5)
- [CVE-2026-78417](https://cve.now/CVE-2026-78417.md): Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.2 (CVSS 4.3)
- [CVE-2026-19768](https://cve.now/CVE-2026-19768.md): Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier a (CVSS 8.1)
- [CVE-2026-8497](https://cve.now/CVE-2026-8497.md): Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Andr (CVSS 7.4)
- [CVE-2026-17570](https://cve.now/CVE-2026-17570.md): Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose (CVSS 4.3)
- [CVE-2026-17569](https://cve.now/CVE-2026-17569.md): Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry (CVSS 4.3)
- [CVE-2026-17568](https://cve.now/CVE-2026-17568.md): Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user hol (CVSS 8.8)
- [CVE-2026-16802](https://cve.now/CVE-2026-16802.md): Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local (CVSS 6.5)
- [CVE-2026-16801](https://cve.now/CVE-2026-16801.md): Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier (CVSS 8.8)
- [CVE-2026-16800](https://cve.now/CVE-2026-16800.md): Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier a (CVSS 8.8)
- [CVE-2026-16799](https://cve.now/CVE-2026-16799.md): Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an au (CVSS 5.0)
- [CVE-2026-16798](https://cve.now/CVE-2026-16798.md): Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows (CVSS 6.5)
- [CVE-2026-15058](https://cve.now/CVE-2026-15058.md): Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to d (CVSS 3.1)
- [CVE-2026-15642](https://cve.now/CVE-2026-15642.md): Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026. (CVSS 3.3)
- [CVE-2026-15641](https://cve.now/CVE-2026-15641.md): Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg (CVSS 7.1)
- [CVE-2026-15637](https://cve.now/CVE-2026-15637.md): Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authent (CVSS 7.5)
- [CVE-2026-14536](https://cve.now/CVE-2026-14536.md): Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user c (CVSS 7.3)
- [CVE-2026-13437](https://cve.now/CVE-2026-13437.md): Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticat (CVSS 6.5)
- [CVE-2026-13372](https://cve.now/CVE-2026-13372.md): Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2. (CVSS 7.2)
- [CVE-2026-12755](https://cve.now/CVE-2026-12755.md): Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated us (CVSS 2.7)
- [CVE-2026-10696](https://cve.now/CVE-2026-10696.md): Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet communi (CVSS 7.5)
- [CVE-2026-12105](https://cve.now/CVE-2026-12105.md): Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication (CVSS 6.5)
- [CVE-2026-12117](https://cve.now/CVE-2026-12117.md): Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enu (CVSS 4.3)
- [CVE-2026-11890](https://cve.now/CVE-2026-11890.md): Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve (CVSS 4.3)
- [CVE-2026-12162](https://cve.now/CVE-2026-12162.md): Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclos (CVSS 5.5)
- [CVE-2026-12161](https://cve.now/CVE-2026-12161.md): Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH en (CVSS 8.8)
- [CVE-2026-8694](https://cve.now/CVE-2026-8694.md): Improper access control on the API documentation endpoint in PowerShell Universal (CVSS 5.3)
- [CVE-2026-10544](https://cve.now/CVE-2026-10544.md): Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authent (CVSS 6.5)
- [CVE-2026-10787](https://cve.now/CVE-2026-10787.md): Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata (CVSS 4.3)
- [CVE-2026-10786](https://cve.now/CVE-2026-10786.md): Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cl (CVSS 6.5)
- [CVE-2026-9522](https://cve.now/CVE-2026-9522.md): Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user withou (CVSS 5.4)
- [CVE-2026-9590](https://cve.now/CVE-2026-9590.md): Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with (CVSS 5.3)
- [CVE-2026-7325](https://cve.now/CVE-2026-7325.md): Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain a (CVSS 7.1)
- [CVE-2026-9251](https://cve.now/CVE-2026-9251.md): Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass t (CVSS 5.4)
- [CVE-2026-5171](https://cve.now/CVE-2026-5171.md): Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but wit (CVSS 4.3)
- [CVE-2026-8477](https://cve.now/CVE-2026-8477.md): Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticate (CVSS 2.7)
- [CVE-2026-9246](https://cve.now/CVE-2026-9246.md): Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault rea (CVSS 4.3)
- [CVE-2026-9224](https://cve.now/CVE-2026-9224.md): Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their (CVSS 4.3)
- [CVE-2026-9249](https://cve.now/CVE-2026-9249.md): Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a cra (CVSS 3.1)
- [CVE-2026-9245](https://cve.now/CVE-2026-9245.md): Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to re (CVSS 5.0)
- [CVE-2026-9247](https://cve.now/CVE-2026-9247.md): Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a seal (CVSS 2.4)
- [CVE-2026-9248](https://cve.now/CVE-2026-9248.md): Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to c (CVSS 2.6)
- [CVE-2026-9223](https://cve.now/CVE-2026-9223.md): Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user (CVSS 4.3)
- [CVE-2026-9047](https://cve.now/CVE-2026-9047.md): Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with kn (CVSS 7.6)
- [CVE-2026-5146](https://cve.now/CVE-2026-5146.md): Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delet (CVSS 4.3)
- [CVE-2026-8407](https://cve.now/CVE-2026-8407.md): Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions (CVSS 4.3)
- [CVE-2026-6706](https://cve.now/CVE-2026-6706.md): Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation co (CVSS 6.5)
- [CVE-2026-4989](https://cve.now/CVE-2026-4989.md): Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform se (CVSS 4.3)
- [CVE-2026-5175](https://cve.now/CVE-2026-5175.md): Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to de (CVSS 5.0)
- [CVE-2026-4925](https://cve.now/CVE-2026-4925.md): Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restric (CVSS 5.0)
- [CVE-2026-4927](https://cve.now/CVE-2026-4927.md): Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain othe (CVSS 6.5)
- [CVE-2026-4924](https://cve.now/CVE-2026-4924.md): Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacke (CVSS 8.2)
- [CVE-2026-4828](https://cve.now/CVE-2026-4828.md): Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid cre (CVSS 8.2)
- [CVE-2026-4829](https://cve.now/CVE-2026-4829.md): Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user t (CVSS 5.4)
- [CVE-2026-4434](https://cve.now/CVE-2026-4434.md): Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack vi (CVSS 8.1)
- [CVE-2026-4396](https://cve.now/CVE-2026-4396.md): Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in- (CVSS 8.3)
- [CVE-2026-3563](https://cve.now/CVE-2026-3563.md): Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with (CVSS 5.5)
- [CVE-2026-4064](https://cve.now/CVE-2026-4064.md): Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with an (CVSS 8.3)
- [CVE-2026-3638](https://cve.now/CVE-2026-3638.md): Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authent (CVSS 5.9)
- [CVE-2026-3130](https://cve.now/CVE-2026-3130.md): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete per (CVSS 9.8)
- [CVE-2026-3204](https://cve.now/CVE-2026-3204.md): Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displa (CVSS 9.8)
- [CVE-2026-2590](https://cve.now/CVE-2026-2590.md): Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Mana (CVSS 9.8)
- [CVE-2026-3224](https://cve.now/CVE-2026-3224.md): Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unaut (CVSS 9.8)
- [CVE-2026-3277](https://cve.now/CVE-2026-3277.md): The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext i (CVSS 5.5)
- [CVE-2026-3221](https://cve.now/CVE-2026-3221.md): Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker w (CVSS 4.9)
- [CVE-2026-3131](https://cve.now/CVE-2026-3131.md): Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user wit (CVSS 6.5)
- [CVE-2026-1768](https://cve.now/CVE-2026-1768.md): A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This iss (CVSS 4.3)
- [CVE-2026-1007](https://cve.now/CVE-2026-1007.md): Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue (CVSS 7.6)
- [CVE-2026-0610](https://cve.now/CVE-2026-0610.md): SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 (CVSS 9.8)
- [CVE-2026-0747](https://cve.now/CVE-2026-0747.md): Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025 (CVSS 3.3)
- [CVE-2026-0618](https://cve.now/CVE-2026-0618.md): Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. (CVSS 6.1)
- [CVE-2025-13683](https://cve.now/CVE-2025-13683.md): Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Serve (CVSS 6.5)
- [CVE-2025-13758](https://cve.now/CVE-2025-13758.md): Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. (CVSS 3.5)
- [CVE-2025-13757](https://cve.now/CVE-2025-13757.md): SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025. (CVSS 8.8)
- [CVE-2025-13765](https://cve.now/CVE-2025-13765.md): Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: be (CVSS 4.3)
- [CVE-2025-12485](https://cve.now/CVE-2025-12485.md): Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate (CVSS 8.8)
- [CVE-2025-12808](https://cve.now/CVE-2025-12808.md): Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custo (CVSS 6.5)
- [CVE-2025-11957](https://cve.now/CVE-2025-11957.md): Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to (CVSS 9.0)
- [CVE-2025-11958](https://cve.now/CVE-2025-11958.md): An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticat (CVSS 5.1)
- [CVE-2025-11619](https://cve.now/CVE-2025-11619.md): Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to (CVSS 8.8)
- [CVE-2025-8312](https://cve.now/CVE-2025-8312.md): Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out (CVSS 7.1)
- [CVE-2025-8353](https://cve.now/CVE-2025-8353.md): UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a r (CVSS 5.9)
- [CVE-2025-6741](https://cve.now/CVE-2025-6741.md): Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the (CVSS 7.1)
- [CVE-2025-6523](https://cve.now/CVE-2025-6523.md): Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authenticat (CVSS 9.5)
- [CVE-2025-0691](https://cve.now/CVE-2025-0691.md): Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E (CVSS 5.0)
- [CVE-2025-5382](https://cve.now/CVE-2025-5382.md): Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to r (CVSS 6.8)
- [CVE-2025-3768](https://cve.now/CVE-2025-3768.md): Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass (CVSS 5.0)
- [CVE-2025-4433](https://cve.now/CVE-2025-4433.md): Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "Us (CVSS 8.7)
- [CVE-2025-5334](https://cve.now/CVE-2025-5334.md): Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows (CVSS 7.5)
- [CVE-2025-4493](https://cve.now/CVE-2025-4493.md): Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorize (CVSS 6.5)
- [CVE-2025-4316](https://cve.now/CVE-2025-4316.md): Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the (CVSS 4.3)
- [CVE-2025-3517](https://cve.now/CVE-2025-3517.md): Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a prev (CVSS 6.3)
- [CVE-2025-2600](https://cve.now/CVE-2025-2600.md): Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the EL (CVSS 6.8)
- [CVE-2025-2562](https://cve.now/CVE-2025-2562.md): Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored (CVSS 5.4)
- [CVE-2025-2528](https://cve.now/CVE-2025-2528.md): Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use (CVSS 3.6)
- [CVE-2025-2499](https://cve.now/CVE-2025-2499.md): Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. (CVSS 5.4)
- [CVE-2025-2280](https://cve.now/CVE-2025-2280.md): Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to (CVSS 8.1)
- [CVE-2025-2278](https://cve.now/CVE-2025-2278.md): Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an a (CVSS 6.5)
- [CVE-2025-1636](https://cve.now/CVE-2025-1636.md): Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and (CVSS 6.5)
- [CVE-2025-1635](https://cve.now/CVE-2025-1635.md): Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows a (CVSS 6.5)
- [CVE-2025-2277](https://cve.now/CVE-2025-2277.md): Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently le (CVSS 7.5)
- [CVE-2025-2003](https://cve.now/CVE-2025-2003.md): Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' p (CVSS 7.1)
- [CVE-2025-1231](https://cve.now/CVE-2025-1231.md): Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user pa (CVSS 5.4)
- [CVE-2024-11621](https://cve.now/CVE-2024-11621.md): Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modif (CVSS 8.8)
- [CVE-2025-1193](https://cve.now/CVE-2025-1193.md): Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows a (CVSS 8.1)
- [CVE-2024-12148](https://cve.now/CVE-2024-12148.md): Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to acce (CVSS 4.3)
- [CVE-2024-12149](https://cve.now/CVE-2024-12149.md): Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Wind (CVSS 8.1)
- [CVE-2024-12151](https://cve.now/CVE-2024-12151.md): Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old (CVSS 5.0)
- [CVE-2024-12196](https://cve.now/CVE-2024-12196.md): Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the pa (CVSS 6.5)
- [CVE-2024-11862](https://cve.now/CVE-2024-11862.md): Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption (CVSS 5.1)
- [CVE-2024-11670](https://cve.now/CVE-2024-11670.md): Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows (CVSS 5.4)
- [CVE-2024-11671](https://cve.now/CVE-2024-11671.md): Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an a (CVSS 5.4)
- [CVE-2024-11672](https://cve.now/CVE-2024-11672.md): Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an aut (CVSS 4.3)
- [CVE-2024-10971](https://cve.now/CVE-2024-10971.md): Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to ob (CVSS 4.3)
- [CVE-2024-7421](https://cve.now/CVE-2024-7421.md): An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to syste (CVSS 5.5)
- [CVE-2024-6512](https://cve.now/CVE-2024-6512.md): Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users wit (CVSS 6.5)
- [CVE-2024-6492](https://cve.now/CVE-2024-6492.md): Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Win (CVSS 7.4)
- [CVE-2024-6354](https://cve.now/CVE-2024-6354.md): Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user (CVSS 7.2)
- [CVE-2024-4846](https://cve.now/CVE-2024-4846.md): Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to a (CVSS 6.3)
- [CVE-2024-6057](https://cve.now/CVE-2024-6057.md): Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that (CVSS 9.8)
- [CVE-2024-6055](https://cve.now/CVE-2024-6055.md): Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Win (CVSS 4.7)
- [CVE-2024-5072](https://cve.now/CVE-2024-5072.md): Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with acces (CVSS 6.5)
- [CVE-2024-3545](https://cve.now/CVE-2024-3545.md): Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and D (CVSS 4.3)
- [CVE-2024-2918](https://cve.now/CVE-2024-2918.md): Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM (CVSS 3.6)
- [CVE-2024-2921](https://cve.now/CVE-2024-2921.md): Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t (CVSS 9.8)
- [CVE-2024-2915](https://cve.now/CVE-2024-2915.md): Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevat (CVSS 8.8)
- [CVE-2024-2403](https://cve.now/CVE-2024-2403.md): Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an atta (CVSS 5.9)
- [CVE-2024-2241](https://cve.now/CVE-2024-2241.md): Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintend (CVSS 6.3)
- [CVE-2024-1764](https://cve.now/CVE-2024-1764.md): Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue (CVSS 7.6)
- [CVE-2024-1898](https://cve.now/CVE-2024-1898.md): Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change not (CVSS 3.9)
- [CVE-2024-1900](https://cve.now/CVE-2024-1900.md): Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticat (CVSS 5.5)
- [CVE-2024-1901](https://cve.now/CVE-2024-1901.md): Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with s (CVSS 4.3)
- [CVE-2024-0589](https://cve.now/CVE-2024-0589.md): Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows al (CVSS 5.4)
- [CVE-2023-7047](https://cve.now/CVE-2023-7047.md): Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager (no CVSS)
- [CVE-2023-6593](https://cve.now/CVE-2023-6593.md): Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to th (no CVSS)
- [CVE-2023-6588](https://cve.now/CVE-2023-6588.md): Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 a (no CVSS)
- [CVE-2023-6288](https://cve.now/CVE-2023-6288.md): Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB\_INSERT\_LIBRARIES e (no CVSS)
- [CVE-2023-6264](https://cve.now/CVE-2023-6264.md): Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configure (no CVSS)
- [CVE-2023-5358](https://cve.now/CVE-2023-5358.md): Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from v (no CVSS)
- [CVE-2023-5765](https://cve.now/CVE-2023-5765.md): Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an at (no CVSS)
- [CVE-2023-5766](https://cve.now/CVE-2023-5766.md): A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute co (CVSS 8.8)
- [CVE-2023-5575](https://cve.now/CVE-2023-5575.md): Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a (no CVSS)
- [CVE-2023-5240](https://cve.now/CVE-2023-5240.md): Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PA (no CVSS)
- [CVE-2023-4417](https://cve.now/CVE-2023-4417.md): Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows (no CVSS)
- [CVE-2023-4373](https://cve.now/CVE-2023-4373.md): Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 an (CVSS 9.8)
- [CVE-2023-2400](https://cve.now/CVE-2023-2400.md): Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view use (CVSS 2.7)
- [CVE-2023-2445](https://cve.now/CVE-2023-2445.md): Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator p (CVSS 4.9)
- [CVE-2023-2282](https://cve.now/CVE-2023-2282.md): Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authentic (CVSS 3.1)
- [CVE-2023-2257](https://cve.now/CVE-2023-2257.md): Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an att (CVSS 6.1)
- [CVE-2023-2118](https://cve.now/CVE-2023-2118.md): Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send su (CVSS 4.3)
- [CVE-2023-1939](https://cve.now/CVE-2023-1939.md): No access control for the OTP key on OTP entries (CVSS 4.3)
- [CVE-2023-1980](https://cve.now/CVE-2023-1980.md): Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor (CVSS 6.5)
- [CVE-2023-1603](https://cve.now/CVE-2023-1603.md): Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users w (CVSS 6.5)
- [CVE-2023-1202](https://cve.now/CVE-2023-1202.md): Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions (CVSS 6.5)
- [CVE-2023-1580](https://cve.now/CVE-2023-1580.md): Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of (CVSS 7.5)
- [CVE-2023-1574](https://cve.now/CVE-2023-1574.md): Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windo (CVSS 6.5)
- [CVE-2023-1201](https://cve.now/CVE-2023-1201.md): Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that posse (no CVSS)
- [CVE-2023-1203](https://cve.now/CVE-2023-1203.md): Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Modu (no CVSS)
- [CVE-2023-0952](https://cve.now/CVE-2023-0952.md): Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data (CVSS 6.5)
- [CVE-2023-0951](https://cve.now/CVE-2023-0951.md): Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perfor (CVSS 8.8)
- [CVE-2023-0953](https://cve.now/CVE-2023-0953.md): Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to (CVSS 8.8)
- [CVE-2023-0661](https://cve.now/CVE-2023-0661.md): Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. (CVSS 6.5)
- [CVE-2023-0463](https://cve.now/CVE-2023-0463.md): The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022 (CVSS 7.8)
- [CVE-2022-4287](https://cve.now/CVE-2022-4287.md): Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malic (CVSS 8.8)
- [CVE-2022-3641](https://cve.now/CVE-2022-3641.md): Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated use (CVSS 8.8)
- [CVE-2022-3781](https://cve.now/CVE-2022-3781.md): Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manage (CVSS 6.5)
- [CVE-2022-3780](https://cve.now/CVE-2022-3780.md): Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow delet (CVSS 7.5)
- [CVE-2022-3182](https://cve.now/CVE-2022-3182.md): Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers (no CVSS)
- [CVE-2022-2316](https://cve.now/CVE-2022-2316.md): HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or r (no CVSS)
- [CVE-2022-2221](https://cve.now/CVE-2022-2221.md): Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users t (no CVSS)
- [CVE-2022-1342](https://cve.now/CVE-2022-1342.md): A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. (no CVSS)
- [CVE-2021-42098](https://cve.now/CVE-2021-42098.md): An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/devolutions
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.