Powershell Universal
Approved changes feed: RSS · Atom
cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Devolutions (7032325e-1090-5501-8038-d00cf17c6e3c) |
|---|---|
| Product | Powershell Universal (91d795ef-90ee-575e-b092-cf50686b87b4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ironmansoftware/powershell-universal |
purl2cpe | 2026-07-28 16:40:49.162004 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92237 |
vulnerable | 2026-09-16 04:33:07.979108 |
Details available
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL parameter values written to the system log on instances backed by Microsoft SQL Server.
Published: 2026-09-15T20:14:31.376Z
Updated: 2026-09-16T17:50:21.780Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8694 |
vulnerable | 2026-07-29 01:09:06.165948 |
Improper access control on the API documentation endpoint in PowerShell Universal
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
Published: 2026-06-12T14:11:33.453Z
Updated: 2026-06-12T15:17:07.858Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13437 |
vulnerable | 2026-07-29 00:23:33.035945 |
Details available
Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.
Published: 2026-06-29T15:23:53.472Z
Updated: 2026-06-29T16:25:22.355Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4064 |
vulnerable | 2026-06-08 08:05:12.557598 |
Details available
Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.
Published: 2026-03-17T19:14:17.189Z
Updated: 2026-03-17T20:03:19.106Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3563 |
vulnerable | 2026-06-08 08:01:18.965939 |
Details available
Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.
Published: 2026-03-17T19:15:37.820Z
Updated: 2026-03-17T20:04:00.419Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3277 |
vulnerable | 2026-06-08 08:01:18.306113 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0618 |
vulnerable | 2026-06-08 07:47:12.750821 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.