Devolutions PowerShell Universal

• CVE-2026-116627 High 8.7 Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user 0.2%
• CVE-2026-92237 Medium 6.5 Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obt 0.4%
• CVE-2026-19768 High 8.1 Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permiss 0.4%
• CVE-2026-16802 Medium 6.5 Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secr 0.1%
• CVE-2026-16801 High 8.8 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission 0.5%
• CVE-2026-16800 High 8.8 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permissio 0.5%
• CVE-2026-16799 Medium 5.0 Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automa 0.3%
• CVE-2026-16798 Medium 6.5 Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permis 0.4%
• CVE-2026-13437 Medium 6.5 Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potent 0.4%
• CVE-2026-8694 Medium 5.3 Improper access control on the API documentation endpoint in PowerShell Universal 0.2%
• CVE-2026-3563 Medium 5.5 Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to overrid 0.4%
• CVE-2026-4064 High 8.3 Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perfo 0.3%
• CVE-2026-3277 Medium 5.5 The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an 0.2%
• CVE-2026-0618 Medium 6.1 Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. 0.2%