Veille CVE

Juin 2026

9 CVE

Critique 0 Élevée 0 Moyenne 8 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Devolutions devolutions server » ✕
  1. CVE-2026-12755 2.7 Faible

    Devolutions Server · Devolutions devolutions server

    Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

  2. CVE-2026-12117 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

  3. CVE-2026-12105 6.5 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.

  4. CVE-2026-11890 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

  5. CVE-2026-10787 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

  6. CVE-2026-10786 6.5 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

  7. CVE-2026-10544 6.5 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

  8. CVE-2026-9590 5.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.

  9. CVE-2026-9522 5.4 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.