CVE-2026-90969

Devolutions Server 2026.2.16 and earlier contains an improper access control flaw in the vault entry listing feature . An authenticated user who lacks the view-password permission can still retrieve cleartext passwords by crafting a request to the entry listing endpoint with specific password dis...

CVE-2025-1987

CVE-2025-1987 describes a stored XSS in Psono-Client via malicious vault entries (website_password and bookmark) with un sanitised URL fields, used in Bitdefender SecurePass. A crafted javascript: URL can execute in the browser when a user interacts with the entry, potentially accessing the user’...

CVE-2023-4417

Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in th...