NVD や CVE、ほか複数の脅威フィードを束ね、RCE など高リスクな事象を深く追える一覧です。CVSS と EPSS を組み合わせ、Exploit 参照や PoC の有無から悪用しやすさを追跡します。ベンダー修正や緩和策の文脈とあわせて優先度を決め、対応サイクルを短く保ちつつ重要資産を守る支援をします。
Assigner（CNA／発行元）：[email protected] この条件を外す
| CVE | 説明 | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|
| CVE-2023-0661 | Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data. | 6.5 | 0.74% | 2023-02-11 | 2026-06-17 |
| CVE-2024-6354 | Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard. | 7.2 | 0.79% | 2024-06-26 | 2026-06-17 |
| CVE-2024-2921 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions. | 9.8 | 0.79% | 2024-03-26 | 2026-06-17 |
| CVE-2023-1201 | Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UUID to access the data it contains. | 6.5 | 0.81% | 2023-03-10 | 2026-06-17 |
| CVE-2024-6057 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature. | 9.8 | 0.92% | 2024-06-17 | 2026-06-17 |
| CVE-2023-2445 | Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name. | 4.9 | 0.98% | 2023-05-02 | 2026-06-17 |
| CVE-2023-0951 | Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actions. | 8.8 | 1.00% | 2023-03-01 | 2026-06-17 |
| CVE-2022-4287 | Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application. | 8.8 | 1.02% | 2022-12-21 | 2026-06-17 |
| CVE-2023-0953 | Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Injection, potentially resulting in unauthorized access to system resources. | 8.8 | 1.03% | 2023-03-01 | 2026-06-17 |
| CVE-2023-1203 | Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Module 2022.3.1.5 and earlier allows an authenticated user to access sensitive data on entries that were edited using the affected submodule. | 6.5 | 1.06% | 2023-03-10 | 2026-06-17 |
| CVE-2022-2221 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8. | 6.5 | 1.11% | 2022-06-27 | 2026-06-17 |
| CVE-2025-1636 | Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic. | 6.5 | 1.58% | 2025-03-13 | 2026-06-17 |
| CVE-2025-1635 | Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic. | 6.5 | 1.58% | 2025-03-13 | 2026-06-17 |
| CVE-2021-42098 | An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell. | 8.8 | 1.60% | 2021-10-18 | 2026-06-17 |
| CVE-2026-13437 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses. | 6.5 | 該当なし | 2026-06-29 | 2026-06-29 |