devguard vulnerabilities

2 known vulnerabilities in devguard from L3montree-dev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  devguard: Improper Authorization

  CVE-2026-48089Jun 19, 2026L3montree-dev

  DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the a

• 9.3 Critical severity

  devguard: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-42300May 12, 2026L3montree-dev

  DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session co