CVE-2026-120734

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1207375.9The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to th CVE-2026-1207397.2The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cro CVE-2026-1207402.0A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read CVE-2026-1207415.4The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2 CVE-2026-1207496.2A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local CVE-2026-1207527.5PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied CVE-2026-1207543.3HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. The decode path CVE-2026-1207555.5HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-compressed chun CVE-2026-1207566.1HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decoding object header CVE-2026-1207577.1HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal call CVE-2026-1207585.5HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a single metadat CVE-2026-120769.3Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline. The vulnerability allows a remote, unauthenticated atta