Input Validation and Logic

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafte…CVE-2026-3204Devolutions · CVSS 9.8 · 0.6% likely

   CWE-20

2. Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker wit…CVE-2026-13372Devolutions · CVSS 7.2 · 0.5% likely

   CWE-706

3. Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is…CVE-2026-3130Devolutions · CVSS 9.8 · 0.5% likely

   CWE-841

4. UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain un…CVE-2025-8353Devolutions · CVSS 5.9 · 0.5% likely

   CWE-446

5. An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to…CVE-2025-11958Devolutions · CVSS 4.1 · 0.4% likely

   CWE-20

6. Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or…CVE-2026-3563Devolutions · CVSS 5.5 · 0.4% likely

   CWE-1289

7. Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to…CVE-2026-12755Devolutions · CVSS 2.7 · 0.4% likely

   CWE-1284

8. Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an insta…CVE-2026-10696Devolutions · CVSS 7.5 · 0.3% likely

   CWE-706

9. Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to…CVE-2026-8477Devolutions · CVSS 2.7 · 0.2% likely

   CWE-841

10. Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host rulese…CVE-2026-93330Devolutions · CVSS 4.3 · 0.2% likely

    CWE-696

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.