Skip to contentDevolutions Server vulnerabilities
- devolutions serverFile owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files...CVE-2026-77165Fix available6.5 Medium
- devolutions serverThe Photos app's filter-based "smart albums" build their file listing using the search...CVE-2026-82985Fix available6.5 Medium
- devolutions serverCircles' remote-instance signature verification fetches the attacker-supplied keyId URL before...CVE-2026-77164Fix available6.2 Medium
- devolutions serverAfter guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve...CVE-2026-68493Fix available3.1 Low
- devolutions serverImproper certificate validation on LDAPS connections to Active Directory in Devolutions Server...CVE-2026-133278.3 High
- devolutions serverImproper certificate validation in the shared HTTP client used by synchronization and integration...CVE-2026-848504.8 Medium
- devolutions serverImproper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and...CVE-2026-909696.5 Medium
- devolutions serverServer-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server...CVE-2026-909716.5 Medium
- devolutions serverLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationCVE-2026-540479.2 Critical
- budibase serverBudibase Server before 3.41.3 SSRF via Query ImportCVE-2026-822467.1 High
- budibase serverBudibase before 3.41.3 Missing Authorization License ManagementCVE-2026-822457.2 High
- budibase serverBudibase before 3.41.3 Remote Code Execution via Plugin eval()CVE-2026-822449.4 Critical
- budibase serverBudibase Server before 3.41.3 SSRF with Credential LeakageCVE-2026-822438.3 High
- budibase serverBudibase before 3.41.3 Cross-Application Resource Injection via Missing AuthorizationCVE-2026-822428.3 High
- budibase serverBudibase backend-core SSRF via incomplete default blacklistCVE-2026-822417.1 High
- budibase serverBudibase before 3.41.3 Privilege Escalation via User Update APICVE-2026-822408.6 High
- budibase serverBudibase before 3.41.3 Authorization Bypass via datasources/queryCVE-2026-822398.6 High
- budibase serverBudibase before 3.40.0 SQL Injection via Unauthenticated WebhookCVE-2026-728519.0 Critical
- budibase serverBudibase before 3.40.0 Arbitrary File Write via Path TraversalCVE-2026-728509.4 Critical
- bitwarden serverBitwarden Server < 2026.7.2 Audit Log Injection via POST /collectCVE-2026-719596.9 Medium
- devolutions serverImproper access control in the PAM password history endpoints in Devolutions Server allows an...CVE-2026-175704.3 Medium
- devolutions serverImproper access control in the NetBox synchronizer in Devolutions Server allows an authenticated...CVE-2026-175694.3 Medium
- devolutions serverImproper access control in the role membership management endpoint in Devolutions Server allows...CVE-2026-175688.8 High
- budibase serverBudibase before 3.40.0 NoSQL Injection via MongoDB datasourceCVE-2026-736177.1 High
- budibase serverBudibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRFCVE-2026-728498.7 High
- budibase serverBudibase Server before 3.40.0 NoSQL Injection via JSON ParameterCVE-2026-736188.7 High
- budibase serverBudibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTCVE-2026-728558.4 High
- budibase serverBudibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLCVE-2026-728598.3 High
- devolutions serverImproper access control in Hashtopolis server chunk activity componentCVE-2026-221047.1 High
- devolutions serverImproper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11,...CVE-2026-150583.1 Low
- devolutions serverInsertion of sensitive information into a file in the Recovery Kit response file generation...CVE-2026-156423.3 Low
- devolutions serverImproper authorization in the access request status endpoint in Devolutions Server 2026.2.11,...CVE-2026-156417.1 High
- devolutions serverImproper authorization in the PAM SSH key and certificate retrieval
endpoints in Devolutions...CVE-2026-156377.5 High
- bitwarden serverBitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth RequestCVE-2026-601049.3 Critical
- devolutions serverImproper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026...CVE-2026-145368.8 High
- bitwarden serverBitwarden Server < 2026.5.0 JSON Injection via Webhook TemplatesCVE-2026-575222.3 Low
- bitwarden serverBitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceControllerCVE-2026-575215.3 Medium
- bitwarden serverBitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove EndpointCVE-2026-575207.1 High
- devolutions serverImproper input validation in the PAM AD discovery endpoints in
Devolutions Server 2026.2.4.0...CVE-2026-127552.7 Low
- devolutions serverImproper access control in Devolutions Server 2026.2.5, 2026.1.21 allows
an authenticated user...CVE-2026-121056.5 Medium
- devolutions serverImproper access control in the social login connection endpoint in
Devolutions Server 2026.2.5...CVE-2026-121174.3 Medium
- devolutions serverImproper access control in PAM account discovery results in Devolutions
Server 2026.2.5, 2026.1...CVE-2026-118904.3 Medium
- devolutions serverImproper neutralization of special elements in the built-in PAM provider password rotation...CVE-2026-105446.5 Medium
- devolutions serverMissing authorization in the deleted user groups API in Devolutions Server allows an...CVE-2026-107874.3 Medium
- devolutions serverImproper access control in the ticketing integration settings in Devolutions Server allows an...CVE-2026-107866.5 Medium
- devolutions serverSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIPCVE-2026-47684Fix available7.7 High
- devolutions serverImproper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and...CVE-2026-95225.4 Medium
- devolutions serverImproper access control in the permission validation component in Devolutions Server 2026.1.19...CVE-2026-95905.3 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +6 more +8 moreMariaDB server has unsafe parameter handling in `wsrep_notify_cmd`CVE-2026-49261Fix available10.0 Critical
- devolutions server, mariadb, red hat enterprise linux 7 +6 more +8 moreMariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideCVE-2026-48165Fix available8.0 High
- Show moreLoading…