Devolutions Server

Every one of the 24 is a mark on the map. Named now: 1 to 24, most at risk first.

1. Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user.CVE-2022-33996Devolutions · 1.1% likely

   CWE-276

2. An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.CVE-2021-23924Devolutions · 1.0% likely

   CWE-532

3. An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.CVE-2021-23921Devolutions · 1.0% likely
4. Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially…CVE-2023-0953Devolutions · CVSS 8.8 · 1.0% likely

   CWE-89

5. Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actions.CVE-2023-0951Devolutions · CVSS 8.8 · 1.0% likely
6. Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information…CVE-2023-2445Devolutions · CVSS 4.9 · 1.0% likely

   CWE-346

7. An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a userna…CVE-2021-28157Devolutions · 0.9% likely

   CWE-89

8. Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UUID to access the dat…CVE-2023-1201Devolutions · 0.8% likely
9. An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.CVE-2021-23923Devolutions · 0.8% likely

   CWE-287

10. Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.CVE-2023-0661Devolutions · CVSS 6.5 · 0.7% likely

    CWE-284

11. Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper authorization.CVE-2023-0952Devolutions · CVSS 6.5 · 0.7% likely

    CWE-863

12. Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed t…CVE-2023-5358Devolutions · 0.7% likely
13. Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (…CVE-2021-36382Devolutions · CVSS 2.6 · 0.7% likely

    CWE-319

14. An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.CVE-2021-23925Devolutions · 0.6% likely

    CWE-79

15. An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted H…CVE-2021-28048Devolutions · 0.6% likely

    CWE-346

16. HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site.CVE-2022-2316Devolutions · 0.6% likely

    CWE-79

17. Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic f…CVE-2023-2118Devolutions · CVSS 4.3 · 0.4% likely
18. Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a…CVE-2025-3517Devolutions · CVSS 6.3 · 0.3% likely

    CWE-266

19. Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.CVE-2026-12105Devolutions · CVSS 6.5 · 0.3% likely

    CWE-862

20. Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requ…CVE-2024-6512Devolutions · CVSS 6.5 · 0.3% likely

    CWE-863

21. Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to whi…CVE-2026-12117Devolutions · CVSS 4.3 · 0.3% likely

    CWE-200

22. A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2…CVE-2026-1768Devolutions · CVSS 4.3 · 0.3% likely

    CWE-863

23. Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.CVE-2025-11619Devolutions · CVSS 8.8 · 0.2% likely

    CWE-295

24. Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.CVE-2026-11890Devolutions · CVSS 4.3 · 0.2% likely

    CWE-882

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.