CVE-2026-8694

Devolutions PowerShell Universal versions 2026.1.7 and earlier are vulnerable to an improper access control flaw. This vulnerability allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints. No specific exploits or remediation steps are provided...

CVE-2026-3277

The vulnerability CVE-2026-3277 affects PowerShell Universal prior to version 2026.1.3, where the OpenID Connect (OIDC) client secret is stored in cleartext in the .universal/authentication.ps1 script. An attacker with read access to that file can obtain the OIDC client credentials, leading to po...

CVE-2026-4064

PowerShell Universal, a platform developed by Devolutions , is vulnerable to a security flaw in versions prior to 2026.1.4 . The issue is caused by missing authorization checks on multiple gRPC service endpoints , which allows an authenticated user with a valid token to bypass role-based access c...

CVE-2026-3563

Devolutions PowerShell Universal versions prior to 2026.1.4 are vulnerable to a security flaw caused by improper input validation within the apps and endpoints configuration. An authenticated user with sufficient permissions can create or modify Apps or Endpoints to override existing application ...

CVE-2026-0618

A Cross-site Scripting (XSS) vulnerability exists in Devolutions PowerShell Universal due to improper input neutralization during web page generation. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to malicious code execution wit...