Devolutions: >> Unigetui >> 2026.1.0.0 Security Vulnerabilities
Use of an incorrectly resolved name or reference in the pinget backend
in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community
catalog contributor to cause an installed application to be correlated
to an unrelated, attacker-controlled catalog package and to execute an
attacker-controlled installer via a crafted catalog package whose
normalized name is contained as a substring within the installed
application name when a user applies the proposed update.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-06-17