14 matches found
Devolutions Server < 2026.2.21.0 / 2026.3.5.0 < 2026.3.11.0 Multiple Vulnerabilities (DEVO-2026-0037)
The version of Devolutions Server installed on the remote host is prior to 2026.2.21.0, or is 2026.3.5.0 through 2026.3.10.0. It is, therefore, affected by multiple vulnerabilities, including: - Missing authorization in the PAM AD computer import endpoint in Devolutions Server allows an...
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
EUVD-2026-108217
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-114485
Devolutions Server versions 2026.3.10.0 and earlier are vulnerable to an information disclosure flaw caused by insufficient protection of sensitive information in the user list endpoint . An authenticated attacker with delegated user view permissions can exploit this by requesting the user list A...
PT-2026-121410
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-68964
The Gitea platform is vulnerable to a metadata disclosure vulnerability because the user SSH and GPG key-list API endpoints omit the profile visibility checks applied to web equivalents. An authenticated account with restricted status can access public keys, key titles, fingerprints, and GPG-embe...
CVE-2026-65956
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...
GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
PT-2026-80457
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
EUVD-2026-60240
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...