Vulnerability Details CVE-2026-10696
Use of an incorrectly resolved name or reference in the pinget backend
in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community
catalog contributor to cause an installed application to be correlated
to an unrelated, attacker-controlled catalog package and to execute an
attacker-controlled installer via a crafted catalog package whose
normalized name is contained as a substring within the installed
application name when a user applies the proposed update.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 18.8%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-10696
-
cpe:2.3:a:devolutions:unigetui:2026.1.0.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.1.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.10.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.11.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.2.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.3.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.4.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.5.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.6.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.7.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.8.0
-
cpe:2.3:a:devolutions:unigetui:2026.1.9.0
-
cpe:2.3:a:devolutions:unigetui:2026.2.0.0