PowerShell Universal vulnerabilities
5 known vulnerabilities in PowerShell Universal from Devolutions. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
PowerShell Universal: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary J
- 8.1 High severity
PowerShell Universal: Improper Control of Generation of Code
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setti
- 8.8 High severity
PowerShell Universal: Improper Control of Generation of Code
Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable
- 8.8 High severity
PowerShell Universal: Improper Control of Generation of Code
Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule
- 8.3 High severity
PowerShell Universal: Missing Authorization
Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data,