CVE-2026-16802

Devolutions PowerShell Universal versions 2026.2.2 and earlier (prior to 2026.2.3) are vulnerable to cleartext storage of sensitive information within the variables feature . If no vault is selected, secret variables are stored in cleartext on disk , allowing a local actor with file system access...

EUVD-2026-48609

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

CVE-2026-16802

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

CVE-2026-16801

Devolutions PowerShell Universal versions 2026.2.2 and earlier are vulnerable to a Code Injection flaw in the variables feature. An authenticated user with variable write permissions can execute arbitrary PowerShell code by providing a crafted variable value that is not properly escaped when writ...

EUVD-2026-48608

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

CVE-2026-16801

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...

CVE-2026-16800

Devolutions PowerShell Universal versions prior to 2026.2.3 (specifically 2026.2.2 and earlier) are vulnerable to a Code Injection flaw in the schedule feature. An authenticated user with schedule creation permissions can execute arbitrary PowerShell code by providing crafted schedule parameter n...

CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

EUVD-2026-48607

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

CVE-2026-16800

Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...

CVE-2026-16799

Devolutions PowerShell Universal versions 2026.2.2 and earlier are vulnerable to improper access control within the automation tests and workflows features. Due to missing server-side authorization checks, an authenticated user with only the Reader role can execute automation tests and modify wor...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

EUVD-2026-48606

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-16798

The Devolutions PowerShell Universal software (versions 2026.2.2 and earlier ) contains a vulnerability in the automation jobs API where sensitive information is improperly included in sent data. Due to a failure to strip OAuth refresh tokens from job read responses, an authenticated user possess...

EUVD-2026-48605

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

fleet-cve-scanner v1.1.0

fleet-cve-scanner An open-source, single-script CVE scanner for RMM-managed fleets. Pure PowerShell 7, no agents, no appliances, no license fees. It answers one question for every piece of software on every endpoint you manage: is the installed version known to be vulnerable, and how urgent is it...

CVE-2026-16802: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

PT-2026-64309

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper control of code generation in the schedule feature allows an authenticated user with schedule creation permissions to execute arbitrary PowerShell code. This occu...

CVE-2026-16801: Improper Control of Generation of Code

Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...