CVE-2026-10696

Devolutions UniGetUI versions 2026.2.0 and earlier are vulnerable to arbitrary code execution due to an incorrectly resolved name or reference in the pinget backend . A malicious WinGet community catalog contributor can craft a catalog package whose normalized name is a substring of an installed ...

PT-2026-50524

Name of the Vulnerable Software and Affected Versions Devolutions UniGetUI versions prior to 2026.2.1 Description The pinget backend contains an issue where names or references are incorrectly resolved. This allows a WinGet community catalog contributor to correlate an installed application with ...