GCVE - cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Devolutions (`7032325e-1090-5501-8038-d00cf17c6e3c`)
Product	Powershell Universal (`91d795ef-90ee-575e-b092-cf50686b87b4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
`pkg:github/ironmansoftware/powershell-universal`	purl2cpe	2026-07-28 16:40:49.162004

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-8694`	vulnerable	2026-07-29 01:09:06.165948	Improper access control on the API documentation endpoint in PowerShell Universal Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints. Published: 2026-06-12T14:11:33.453Z Updated: 2026-06-12T15:17:07.858Z Open on db.gcve.eu Reference links https://devolutions.net/security/advisories/DEVO-2026-0016/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-13437`	vulnerable	2026-07-29 00:23:33.035945	Details available Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses. Published: 2026-06-29T15:23:53.472Z Updated: 2026-06-29T16:25:22.355Z Open on db.gcve.eu Reference links https://devolutions.net/security/advisories/DEVO-2026-0022/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-4064`	vulnerable	2026-06-08 08:05:12.557598	Details available Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests. Published: 2026-03-17T19:14:17.189Z Updated: 2026-03-17T20:03:19.106Z Open on db.gcve.eu Reference links https://devolutions.net/security/advisories/DEVO-2026-0008	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3563`	vulnerable	2026-06-08 08:01:18.965939	Details available Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path. Published: 2026-03-17T19:15:37.820Z Updated: 2026-03-17T20:04:00.419Z Open on db.gcve.eu Reference links https://devolutions.net/security/advisories/DEVO-2026-0008	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3277`	vulnerable	2026-06-08 08:01:18.306113	Details available The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials Published: 2026-02-27T15:11:18.252Z Updated: 2026-03-30T20:43:33.695Z Open on db.gcve.eu Reference links https://devolutions.net/security/advisories/DEVO-2026-0006	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-0618`	vulnerable	2026-06-08 07:47:12.750821	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.