CVE-2026-120734

The record

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

Affected packages

Related vulnerabilities

• CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because… CWE-319
• CVE-2026-115495 Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile… CWE-319
• CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability… CWE-319
• CVE-2026-70379 When the vSolution Matrix feature is enabled, affected devices may make current screen… CWE-319
• CVE-2026-116196 Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that… CWE-319
• CVE-2026-116200 Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap()… CWE-319
• CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never… CWE-319
• CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. CWE-319