Powershell Universal CVE-2026-3277

The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary comman

Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute

Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creat

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with

PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing

The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf

Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, en

OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with

Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system

PowerShell Universal versions before 4.5.6 and 5.6.13 contain a stored cross-site scripting vulnerability that allows un

PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoin

Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell