CVE-2026-10696: Devolutions Unigetui

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.

Affected products

• Devolutions Unigetui: before 2026.2.1.0 (fixed in 2026.2.1.0)

Published 2026-06-17. Last modified 2026-06-24.