Devolutions Server vulnerabilities

• bitwarden server Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create CVE-2026-119414 5.3 MediumOctober 30, 2026
• devolutions server When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle… CVE-2026-82984 4.3 MediumOctober 27, 2026
• devolutions server App passwords were allowed to bypass password confirmation on sensitive endpoints. CVE-2026-77172 5.3 MediumOctober 27, 2026
• devolutions server Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three d… CVE-2026-77167 7.5 HighOctober 27, 2026
• devolutions server Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0... CVE-2026-114487 4.3 MediumOctober 22, 2026
• devolutions server Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3... CVE-2026-114486 4.3 MediumOctober 22, 2026
• devolutions server Insufficient protection of sensitive information in the user list endpoint in Devolutions Server ... CVE-2026-114485 4.3 MediumOctober 22, 2026
• devolutions server, mariadb +1 more MariaDB: Insufficient quoting in mariadb-dump and SHOW commands CVE-2026-86047 Fix available 7.7 HighOctober 16, 2026
• devolutions server, mariadb +1 more MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon. CVE-2026-85745 Fix available 4.3 MediumOctober 16, 2026
• devolutions server, mariadb +1 more MariaDB: Use-after-free with a large number of SYS_REFCURSOR's CVE-2026-85748 Fix available 9.9 CriticalOctober 16, 2026
• devolutions server, mariadb +1 more MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections CVE-2026-85746 Fix available 9.9 CriticalOctober 16, 2026
• devolutions server, mariadb +1 more MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges CVE-2026-97380 Fix available 8.8 HighOctober 16, 2026
• devolutions server, mariadb +1 more MariaDB: Unauthorized file access via CONNECT engine UDFs CVE-2026-85985 Fix available 5.4 MediumOctober 16, 2026
• devolutions server Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and... CVE-2026-110805 2.6 LowOctober 16, 2026
• devolutions server Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions... CVE-2026-110804 4.3 MediumOctober 16, 2026
• devolutions server Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows... CVE-2026-110806 6.5 MediumOctober 16, 2026
• devolutions server Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier... CVE-2026-110287 4.3 MediumOctober 16, 2026
• devolutions server Gotify: Insufficiently Protected Password Change endpoint CVE-2026-102603 Fix available 5.3 MediumOctober 13, 2026
• devolutions server, mariadb +1 more MariaDB: privilege escalation via incorrect view frm parsing CVE-2026-107823 Fix available 7.2 HighOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: database privilege escalation via user / role name collision in the acl cache CVE-2026-107822 Fix available 6.4 MediumOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: insufficient validation of binary frm data when opening a table CVE-2026-107821 Public exploitFix available 8.0 HighOctober 9, 2026
• devolutions server MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure CVE-2026-107819 Fix available 5.9 MediumOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: environment injection via wsrep bootstrap in the mariadb.service file CVE-2026-107818 Fix available 8.4 HighOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: mysql_json plugin OOB reads CVE-2026-107817 Fix available 4.4 MediumOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: `qc_info` plugin can do OOB reads if query contains \0 CVE-2026-107816 Fix available 6.4 MediumOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: one byte OOB write in DOS tables of the CONNECT engine CVE-2026-107815 Fix available 8.5 HighOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: Insecure $HOME in MariaDB rpm packages CVE-2026-107814 Fix available 8.4 HighOctober 9, 2026
• devolutions server, mariadb +1 more MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. CVE-2026-92262 Public exploitFix available 9.9 CriticalOctober 8, 2026
• devolutions server Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an... CVE-2026-105488 7.1 HighOctober 6, 2026
• devolutions server Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and... CVE-2026-105485 6.8 MediumOctober 6, 2026
• devolutions server Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and... CVE-2026-9226 6.8 MediumOctober 6, 2026
• devolutions server Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and... CVE-2026-100289 5.0 MediumSeptember 29, 2026
• devolutions server Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and... CVE-2026-100288 7.2 HighSeptember 29, 2026
• devolutions server Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier... CVE-2026-100287 5.4 MediumSeptember 29, 2026
• devolutions server Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and... CVE-2026-100286 6.5 MediumSeptember 29, 2026
• devolutions server Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and... CVE-2026-93332 5.4 MediumSeptember 29, 2026
• devolutions server Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5... CVE-2026-93330 4.3 MediumSeptember 29, 2026
• budibase server Budibase server before 3.45.0 Cross-Tenant Information Disclosure CVE-2026-100688 7.1 HighSeptember 26, 2026
• budibase server Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast CVE-2026-100687 7.0 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps CVE-2026-100686 8.6 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 Information Disclosure via Chat Links CVE-2026-100685 8.3 HighSeptember 26, 2026
• budibase server Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC CVE-2026-100684 9.2 CriticalSeptember 26, 2026
• budibase server Budibase before 3.45.0 SQL Injection via column-rename DDL CVE-2026-100683 8.9 HighSeptember 26, 2026
• budibase server Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink CVE-2026-100682 8.7 HighSeptember 26, 2026
• budibase server Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook CVE-2026-100681 6.3 MediumSeptember 26, 2026
• budibase server Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import CVE-2026-100680 8.6 HighSeptember 26, 2026
• devolutions server Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) CVE-2026-58272 Fix available 5.3 MediumSeptember 21, 2026
• devolutions server Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` CVE-2026-58270 Fix available 6.5 MediumSeptember 21, 2026
• devolutions server Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` CVE-2026-58269 Fix available 8.1 HighSeptember 21, 2026
• devolutions server @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` CVE-2026-58271 Fix available 6.8 MediumSeptember 21, 2026
• Show olderLoading…