CVE Tools
Track your stack

Server

322 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Server, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Server CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Server CVEs per month
MonthCVEs
2024-123
2025-010
2025-021
2025-035
2025-040
2025-053
2025-063
2025-075
2025-082
2025-090
2025-103
2025-116
2025-122
2026-012
2026-023
2026-039
2026-0410
2026-0519
2026-0619
2026-0712
2026-0816
2026-0928
2026-1031
2026-1110

Severity

How the 322 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical4013%
  • High11236%
  • Medium13743%
  • Low268%

Latest CVEs

The 15 most recently published vulnerabilities affecting Server.

  1. CVE-2026-111770Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another7.7
  2. CVE-2026-111768Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation7.5
  3. CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service6.8
  4. CVE-2026-102523MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION8.0
  5. CVE-2026-120716Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permiss...6.5
  6. CVE-2026-119636Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on ...8.8
  7. CVE-2026-120734Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain ...6.5
  8. CVE-2026-120715Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of ...8.1
  9. CVE-2026-120733Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain ...7.5
  10. CVE-2026-121580Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account c...8.1
  11. CVE-2026-119414Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create4.3
  12. CVE-2026-82984When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be ca...4.3
  13. CVE-2026-77172App passwords were allowed to bypass password confirmation on sensitive endpoints.5.3
  14. CVE-2026-77167Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Th...7.5
  15. CVE-2026-114487Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a ...4.3

Product grouping is registry-driven, with AI assist and human review. How it works