CVE-2026-15642

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of timeout configuration in the http.DefaultClient used for remote post-serve actions. An attacker can exhaust system memory and crash the process by registering a...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

CVE-2026-54990

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-49181

Integer underflow wrap or wraparound in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-58637 Windows Client-Side Caching Elevation of Privilege Vulnerability

...

CVE-2026-58637 Windows Client-Side Caching Elevation of Privilege Vulnerability

...

CVE-2026-58637

CVE-2026-58637 affects Windows Client-Side Caching (CSC) Service. Description and sources confirm a use-after-free vulnerability that enables an authorized local attacker to elevate privileges. Metrics indicate local attack vector, low privileges required, and no user interaction, with high confi...

CVE-2026-58594

CVE-2026-58594 is a Windows Remote Desktop Client RCE vulnerability caused by an integer overflow/wraparound in the RDP client. Public sources (NVD/NCSC/CIRCL) attribute network-based exploitation with potential arbitrary code execution on vulnerable Windows systems. Connected entries confirm the...

CVE-2026-58594 Remote Desktop Client Remote Code Execution Vulnerability

...

CVE-2026-58594 Remote Desktop Client Remote Code Execution Vulnerability

...

CVE-2026-58539

CVE-2026-58539 is a Windows Remote Desktop Client/RDP vulnerability described as an out-of-bounds read that could allow an unauthenticated attacker to disclose information over a network. The connected documents corroborate this as a Windows RDP/Remote Desktop Client issue with public advisories ...

CVE-2026-58546 Windows Remote Desktop Client Information Disclosure Vulnerability

...

CVE-2026-58546 Windows Remote Desktop Client Information Disclosure Vulnerability

...

CVE-2026-58533 Windows Remote Desktop Client Information Disclosure Vulnerability

...

CVE-2026-58535 Windows Remote Desktop Client Information Disclosure Vulnerability

...

CVE-2026-58535

CVE-2026-58535 affects the Windows Remote Desktop Client. The root cause is a use of an uninitialized resource in Windows RDP, enabling an unauthenticated, network-based disclosure of information. Public data from NVD lists CVSS v3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7...

CVE-2026-58535 Windows Remote Desktop Client Information Disclosure Vulnerability

...

CVE-2026-58533

CVE-2026-58533 is listed as a Windows Remote Desktop Client information-disclosure vulnerability stemming from the use of an uninitialized resource in the Windows RDP client. Connected sources confirm the affected component is the Windows Remote Desktop Client and describe the impact as unauthori...