PowerShell Universal

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with varia…CVE-2026-16801Devolutions · CVSS 8.8 · 0.5% likely

   CWE-94

2. Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedu…CVE-2026-16800Devolutions · CVSS 8.8 · 0.5% likely

   CWE-94

3. Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to ob…CVE-2026-13437Devolutions · CVSS 6.5 · 0.4% likely

   CWE-201

4. Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settin…CVE-2026-19768Devolutions · CVSS 8.1 · 0.4% likely

   CWE-94

5. Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or…CVE-2026-3563Devolutions · CVSS 5.5 · 0.4% likely

   CWE-1289

6. Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job…CVE-2026-16798Devolutions · CVSS 6.5 · 0.4% likely

   CWE-201

7. Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log r…CVE-2026-92237Devolutions · CVSS 6.5 · 0.4% likely

   CWE-532

8. Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based acce…CVE-2026-4064Devolutions · CVSS 8.3 · 0.4% likely

   CWE-862

9. Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader r…CVE-2026-16799Devolutions · CVSS 5 · 0.3% likely

   CWE-862

10. Improper access control on the API documentation endpoint in PowerShell UniversalCVE-2026-8694Devolutions · CVSS 5.3 · 0.2% likely

    CWE-306

11. Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows a…CVE-2026-116627Devolutions · CVSS 8.7 · 0.2% likely

    CWE-79

12. The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 scri…CVE-2026-3277Devolutions · CVSS 5.5 · 0.2% likely

    CWE-312

13. Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.CVE-2026-0618Devolutions · CVSS 6.1 · 0.2% likely

    CWE-79

14. Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read s…CVE-2026-16802Devolutions · CVSS 6.5 · 0.1% likely

    CWE-312

15. Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code…CVE-2026-129137Devolutions

    CWE-276

16. Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or u…CVE-2026-102632Devolutions

    CWE-266

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.