Cryptography

Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.

1. Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (…CVE-2021-36382Devolutions · CVSS 2.6 · 0.7% likely

   CWE-319

2. Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devol…CVE-2022-3781Devolutions · CVSS 6.5 · 0.5% likely

   CWE-311

3. Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authe…CVE-2026-2590Devolutions · CVSS 9.8 · 0.5% likely

   CWE-295

4. Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modi…CVE-2025-1193Devolutions · CVSS 8.1 · 0.4% likely

   CWE-295

5. Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database…CVE-2026-120733Devolutions · CVSS 7.5 · 0.2% likely

   CWE-312

6. Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.CVE-2025-11619Devolutions · CVSS 8.8 · 0.2% likely

   CWE-295

7. Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in…CVE-2024-11621Devolutions · CVSS 8.8 · 0.2% likely

   CWE-295

8. Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test…CVE-2026-120734Devolutions · CVSS 6.5 · 0.2% likely

   CWE-319

9. The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 scri…CVE-2026-3277Devolutions · CVSS 5.5 · 0.2% likely

   CWE-312

10. Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sen…CVE-2026-3221Devolutions · CVSS 4.9 · 0.2% likely

    CWE-312

11. Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certif…CVE-2026-4396Devolutions · CVSS 8.3 · 0.2% likely

    CWE-295

12. Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path atta…CVE-2026-78417Devolutions · CVSS 4.3 · 0.2% likely

    CWE-345

13. Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured tick…CVE-2026-10786Devolutions · CVSS 6.5 · 0.1% likely

    CWE-312

14. Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.CVE-2026-4434Devolutions · CVSS 8.1 · 0.1% likely

    CWE-295

15. Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a c…CVE-2026-12162Devolutions · CVSS 5.5 · 0.1% likely

    CWE-297

16. Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned…CVE-2026-84850Devolutions · CVSS 4.8 · 0.1% likely

    CWE-295

17. Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-…CVE-2026-8497Devolutions · CVSS 7.4 · 0.1% likely

    CWE-295

18. Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged d…CVE-2026-13327Devolutions · CVSS 8.3 · 0.1% likely

    CWE-295

19. Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing perm…CVE-2026-126328Devolutions · 0.1% likely

    CWE-312

20. Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read s…CVE-2026-16802Devolutions · CVSS 6.5 · 0.1% likely

    CWE-312

21. Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external iden…CVE-2026-100288Devolutions · CVSS 7.2 · 0.1% likely

    CWE-312

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.