Filtered by vendor Devolutions Subscriptions
Filtered by product Server Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-3204 1 Devolutions 1 Server 2026-03-04 9.8 Critical
Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
CVE-2026-3130 1 Devolutions 1 Server 2026-03-04 9.8 Critical
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
CVE-2026-3224 1 Devolutions 1 Server 2026-03-04 9.8 Critical
Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).
CVE-2026-3221 1 Devolutions 2 Devolutions Server, Server 2026-02-28 4.9 Medium
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
CVE-2026-3131 1 Devolutions 2 Devolutions Server, Server 2026-02-26 6.5 Medium
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.