Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Devolutions Server 2026.1.24, 2026.2.14 Clear all filters
TI-2026-14408 CVE-2026-17570 · GHSA-6w8j-g3mg-6qw4

Authorization bypass in Devolutions Server

Priority LOW 20

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-07-27 Fixed in 2026.1.24, 2026.2.14 CWE-639
TI-2026-14407 CVE-2026-17569 · GHSA-552f-mjvj-8m37

Insufficiently protected credentials in Devolutions Server

Priority LOW 20

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-27 Fixed in 2026.1.24, 2026.2.14 CWE-522
TI-2026-14406 CVE-2026-17568 · GHSA-272h-8p5w-x5r8

Incorrect authorization in Devolutions Server

Priority MEDIUM 40

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to a…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00417 Published 2026-07-27 Fixed in 2026.1.24, 2026.2.14 CWE-863