Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-10696 Name Resolution Vulnerability in Devolutions UniGetUI 2026.2.0 Allows Arbitrary Installer Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10696
Post summary
The post announces the existence of CVE-2026-10696, describing it as a name resolution flaw that enables arbitrary installer execution, but it offers no PoC, exploit code, active exploitation evidence, or patch information.
CVE-2026-10696 Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to… https://www.cve.org/CVERecord?id=CVE-2026-10696
Post summary
The statement announces CVE-2026-10696, describing an incorrectly resolved name or reference in Devolutions UniGetUI’s backend, with no PoC, exploitation, patch, or debunking details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | devolutions | unigetui | - | - | - |