Veille CVE

Mercredi 17 juin 2026

3 CVE

Critique 0 Élevée 0 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Devolutions devolutions server » ✕
  1. CVE-2026-8407 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier

  2. CVE-2026-6706 6.5 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.

  3. CVE-2026-5146 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier