CVE-2026-116627

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

• CWE-79

• https://devolutions.net/security/advisories/DEVO-2026-0038/

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116612A flaw was found in GStreamer Editing Services (gst-editing-…7.8
• CVE-2026-116613The Animated Text Block plugin for WordPress is vulnerable t…7.5
• CVE-2026-11662Type Confusion in Bindings in Google Chrome prior to 149.0.7…8.8
• CVE-2026-116620A security vulnerability has been detected in Tencent RapidJ…7.3
• CVE-2026-116622The Food Store – Online Food Delivery & Pickup plugin for Wo…7.2
• CVE-2026-116623A vulnerability was detected in code-projects Simple Content…7.3
• CVE-2026-11663Use after free in Skia in Google Chrome prior to 149.0.7827.…8.3
• CVE-2026-116631A malicious web page could open a tel link in a window that …5.4
• CVE-2026-116632A malicious web page could insert arbitrary text into the Fa…5.4
• CVE-2026-116634OmniRoute 3.8.50 before 3.8.52 contains a missing authentica…5.9
• CVE-2026-116638The Windows Recovery Environment (WinRE) in Windows 10 and 1…
• CVE-2026-116639A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payr…3.5