https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-120715/https://vulnfeed.org/cve/CVE-2026-120715/Tue, 03 Nov 2026 21:17:04 +0000Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.https://vulnfeed.org/cve/CVE-2026-120733/https://vulnfeed.org/cve/CVE-2026-120733/Tue, 03 Nov 2026 21:17:04 +0000Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.https://vulnfeed.org/cve/CVE-2026-119636/https://vulnfeed.org/cve/CVE-2026-119636/Tue, 03 Nov 2026 21:17:02 +0000Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.https://vulnfeed.org/cve/CVE-2026-121580/https://vulnfeed.org/cve/CVE-2026-121580/Tue, 03 Nov 2026 20:28:01 +0000Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.