Veille CVE

Mardi 29 septembre 2026

4 CVE

Critique 0 Élevée 0 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Devolutions Server » ✕
  1. CVE-2026-93330 4.3 Moyenne

    Devolutions Server

    Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

  2. CVE-2026-100289 5.0 Moyenne

    Devolutions Server

    Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

  3. CVE-2026-100287 5.4 Moyenne

    Devolutions Server

    Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

  4. CVE-2026-100286 6.5 Moyenne

    Devolutions Server

    Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.