Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Devolutions | PowerShell Universal | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://devolutions.net/security/advisories/DEVO-2026-0038/ |
|
Tue, 27 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Cross‑Site Scripting via Crafted Notification Target URL in Devolutions PowerShell Universal |
Tue, 27 Oct 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL. | |
| Weaknesses | CWE-79 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: DEVOLUTIONS
Published:
Updated: 2026-10-27T12:45:34.223Z
Reserved: 2026-10-26T17:37:47.080Z
Link: CVE-2026-116627
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-27T13:16:56.857
Modified: 2026-10-27T13:16:56.857
Link: CVE-2026-116627
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-27T14:30:04Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')