Powershell Universal (Devolutions) - vulnerabilities (CVEs)
14 CVEs, 1 in the last 30 days, 17 known versions, newest CVE from 2026-10-27. Vendor: Devolutions.
CVEs of Powershell Universal
- CVE-2026-116627, 2026-10-27: Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0…
- CVE-2026-92237 - CVSS 6.5 (medium), 2026-09-15: Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an…
- CVE-2026-19768 - CVSS 8.1 (high), 2026-08-14: Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an…
- CVE-2026-16802 - CVSS 6.5 (medium), 2026-07-24: Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file…
- CVE-2026-16801 - CVSS 8.8 (high), 2026-07-24: Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an…
- CVE-2026-16800 - CVSS 8.8 (high), 2026-07-24: Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an…
- CVE-2026-16799 - CVSS 5 (medium), 2026-07-24: Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user…
- CVE-2026-16798 - CVSS 6.5 (medium), 2026-07-24: Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated…
- CVE-2026-13437 - CVSS 6.5 (medium), 2026-06-29: Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI…
- CVE-2026-8694 - CVSS 5.3 (medium), 2026-06-12: Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification…
- CVE-2026-4064 - CVSS 8.3 (high), 2026-03-17: Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to…
- CVE-2026-3563 - CVSS 5.5 (medium), 2026-03-17: Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to…
- CVE-2026-3277 - CVSS 6.5 (medium), 2026-02-27: The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the…
- CVE-2026-0618 - CVSS 6.1 (medium), 2026-01-07: Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.
