CVE Tools
Track your stack

Server

319 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Server, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Server CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Server CVEs per month
MonthCVEs
2024-123
2025-010
2025-021
2025-035
2025-040
2025-053
2025-063
2025-075
2025-082
2025-090
2025-103
2025-116
2025-122
2026-012
2026-023
2026-039
2026-0410
2026-0519
2026-0619
2026-0712
2026-0816
2026-0928
2026-1031
2026-117

Severity

How the 319 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical4013%
  • High10635%
  • Medium13444%
  • Low268%

Latest CVEs

The 15 most recently published vulnerabilities affecting Server.

  1. CVE-2026-102523MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION8.0
  2. CVE-2026-120716Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permiss...—
  3. CVE-2026-119636Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on ...—
  4. CVE-2026-120734Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain ...—
  5. CVE-2026-120715Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of ...—
  6. CVE-2026-120733Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain ...—
  7. CVE-2026-121580Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account c...—
  8. CVE-2026-119414Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create4.3
  9. CVE-2026-82984When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be ca...4.3
  10. CVE-2026-77167Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Th...7.5
  11. CVE-2026-77172App passwords were allowed to bypass password confirmation on sensitive endpoints.5.3
  12. CVE-2026-114487Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a ...4.3
  13. CVE-2026-114486Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative attacker to bypass the Network Access...4.3
  14. CVE-2026-114485Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to ...4.3
  15. CVE-2026-86047MariaDB: Insufficient quoting in mariadb-dump and SHOW commands7.7

Product grouping is registry-driven, with AI assist and human review. How it works