Skip to content
Devolutions vulnerabilities
Newest
-
bitwarden server
Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
CVE-2026-119414
5.3 Medium
-
devolutions server
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle…
CVE-2026-82984
4.3 Medium
-
devolutions server
App passwords were allowed to bypass password confirmation on sensitive endpoints.
CVE-2026-77172
5.3 Medium
-
devolutions server
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three d…
CVE-2026-77167
7.5 High
-
devolutions powershell universal
Improper neutralization of input during web page generation ('Cross-site Scripting') in the...
CVE-2026-116627
No score
-
devolutions server
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0...
CVE-2026-114487
4.3 Medium
-
devolutions server
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3...
CVE-2026-114486
4.3 Medium
-
devolutions server
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server ...
CVE-2026-114485
4.3 Medium
-
devolutions server, mariadb +1 more
MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
CVE-2026-86047
Fix available
7.7 High
-
devolutions server, mariadb +1 more
MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
CVE-2026-85745
Fix available
4.3 Medium
-
devolutions server, mariadb +1 more
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
CVE-2026-85748
Fix available
9.9 Critical
-
devolutions server, mariadb +1 more
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
CVE-2026-85746
Fix available
9.9 Critical
-
devolutions server, mariadb +1 more
MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
CVE-2026-97380
Fix available
8.8 High
-
devolutions server, mariadb +1 more
MariaDB: Unauthorized file access via CONNECT engine UDFs
CVE-2026-85985
Fix available
5.4 Medium
-
devolutions server
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and...
CVE-2026-110805
2.6 Low
-
devolutions server
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions...
CVE-2026-110804
4.3 Medium
-
devolutions server
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows...
CVE-2026-110806
6.5 Medium
-
devolutions server
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier...
CVE-2026-110287
4.3 Medium
-
devolutions server
Gotify: Insufficiently Protected Password Change endpoint
CVE-2026-102603
Fix available
5.3 Medium
-
devolutions server, mariadb +1 more
MariaDB: privilege escalation via incorrect view frm parsing
CVE-2026-107823
Fix available
7.2 High
-
devolutions server, mariadb +1 more
MariaDB: database privilege escalation via user / role name collision in the acl cache
CVE-2026-107822
Fix available
6.4 Medium
-
devolutions server, mariadb +1 more
MariaDB: insufficient validation of binary frm data when opening a table
CVE-2026-107821
Public exploitFix available
8.0 High
-
devolutions server
MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
CVE-2026-107819
Fix available
5.9 Medium
-
devolutions server, mariadb +1 more
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
CVE-2026-107818
Fix available
8.4 High
-
devolutions server, mariadb +1 more
MariaDB: mysql_json plugin OOB reads
CVE-2026-107817
Fix available
4.4 Medium
-
devolutions server, mariadb +1 more
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
CVE-2026-107816
Fix available
6.4 Medium
-
devolutions server, mariadb +1 more
MariaDB: one byte OOB write in DOS tables of the CONNECT engine
CVE-2026-107815
Fix available
8.5 High
-
devolutions server, mariadb +1 more
MariaDB: Insecure $HOME in MariaDB rpm packages
CVE-2026-107814
Fix available
8.4 High
-
devolutions server, mariadb +1 more
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
CVE-2026-92262
Public exploitFix available
9.9 Critical
-
devolutions server
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an...
CVE-2026-105488
7.1 High
-
devolutions server
Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and...
CVE-2026-105485
6.8 Medium
-
devolutions server
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and...
CVE-2026-9226
6.8 Medium
-
devolutions server
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and...
CVE-2026-100289
5.0 Medium
-
devolutions server
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and...
CVE-2026-100288
7.2 High
-
devolutions server
Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier...
CVE-2026-100287
5.4 Medium
-
devolutions server
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and...
CVE-2026-100286
6.5 Medium
-
devolutions server
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and...
CVE-2026-93332
5.4 Medium
-
devolutions server
Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5...
CVE-2026-93330
4.3 Medium
-
budibase server
Budibase server before 3.45.0 Cross-Tenant Information Disclosure
CVE-2026-100688
7.1 High
-
budibase server
Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
CVE-2026-100687
7.0 High
-
budibase server
Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
CVE-2026-100686
8.6 High
-
budibase server
Budibase before 3.45.0 Information Disclosure via Chat Links
CVE-2026-100685
8.3 High
-
budibase server
Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
CVE-2026-100684
9.2 Critical
-
budibase server
Budibase before 3.45.0 SQL Injection via column-rename DDL
CVE-2026-100683
8.9 High
-
budibase server
Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
CVE-2026-100682
8.7 High
-
budibase server
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
CVE-2026-100681
6.3 Medium
-
budibase server
Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
CVE-2026-100680
8.6 High
-
devolutions server
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
CVE-2026-58272
Fix available
5.3 Medium
-
devolutions server
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
CVE-2026-58270
Fix available
6.5 Medium
-
devolutions server
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
CVE-2026-58269
Fix available
8.1 High
- Show olderLoading…