Live › vulnerability › CVE-2026-116627
Go to dashboardDevolutions PowerShell Universal 2026.3.0 and earlier does not sanitize the target URL of notifications. An authenticated user who can create notifications can inject JavaScript that runs in the browser of another user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 13:31 UTC. All times on this page are UTC.
Teams running Devolutions PowerShell Universal or earlier where some users can create notifications. Exposure depends on users with notification creation rights able to target other users; the sources do not say whether default configuration is affected. Instances on a fixed version can skip this.
2026.3.0No product ranges from the sources yet.
2026.3.0 and earlier are affected.2026.3.0; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-116627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.