SE
Product
Server
106
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 26Medium 61Low 11
Watch
Add Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-9223 | 4.3 | May 22 | Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted… Affected: through 2026.1.16.0 |
| CVE-2026-5146 | 4.3 | May 12 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records… Affected: 2026.1.6.0 through 2026.1.15.0; through 2025.3.19.0 |
| CVE-2026-8407 | 4.3 | May 12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery… Affected: 2026.1.6.0 through 2026.1.11.0; through 2025.3.16.0 |
| CVE-2026-4989 | 4.3 | Apr 1 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF),… Affected: 2026.1.1 through 2026.1.11; 2025.3.1 through 2025.3.17 |
| CVE-2025-13765 | 4.3 | Nov 27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9 Affected: before 2025.2.21; before 2025.3.9 |
| CVE-2025-4316 | 4.3 | May 5 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user… Affected: 2025.1.3.0 through 2025.1.6.0; through 2024.3.15.0 |
| CVE-2024-12148 | 4.3 | Dec 4 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints Affected: through 2024.3.6.0 |
| CVE-2024-3545 | 4.3 | Apr 9 | Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier… Affected: through 2024.1.8.0 |
| CVE-2024-1898 | 4.3 | Mar 5 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an… Affected: through 2023.3.14.0 |
| CVE-2024-1901 | 4.3 | Mar 5 | Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM… Affected: through 2023.3.14.0 |
| CVE-2025-11958 | 4.1 | Oct 22 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to… Affected: through 2025.2.15.0 |