Veille CVE

Vendredi 16 octobre 2026

3 CVE sur 4

Critique 0 Élevée 0 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Devolutions devolutions server » ✕
  1. CVE-2026-110806 6.5 Moyenne

    Devolutions Server · Devolutions devolutions server

    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

  2. CVE-2026-110804 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

  3. CVE-2026-110287 4.3 Moyenne

    Devolutions Server · Devolutions devolutions server

    Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.