Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
56172
Total
4442
Critical
16641
High
16421
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-40533 | MEDIUM | 5.3 | An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers … | Sep 18, 2026 |
| CVE-2026-40532 | MEDIUM | 6.5 | A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain … | Sep 18, 2026 |
| CVE-2026-40531 | MEDIUM | 4.3 | An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct … | Sep 18, 2026 |
| CVE-2026-40530 | HIGH | 8.0 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated … | Sep 18, 2026 |
| CVE-2026-21848 | MEDIUM | 5.0 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized … | Sep 18, 2026 |
| CVE-2026-21822 | MEDIUM | 6.3 | HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read … | Sep 18, 2026 |
| CVE-2026-13684 | CRITICAL | 9.8 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to … | Sep 18, 2026 |
| CVE-2026-13683 | LOW | 2.7 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, … | Sep 18, 2026 |
| CVE-2026-13673 | HIGH | 8.8 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated … | Sep 18, 2026 |
| CVE-2026-13666 | LOW | 3.5 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote … | Sep 18, 2026 |
| CVE-2026-13639 | CRITICAL | 9.8 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write … | Sep 18, 2026 |
| CVE-2026-13635 | MEDIUM | 5.3 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers … | Sep 18, 2026 |
| CVE-2026-13623 | MEDIUM | 4.8 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and … | Sep 18, 2026 |
| CVE-2025-13533 | MEDIUM | 4.4 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment … | Sep 18, 2026 |
| CVE-2026-93494 | HIGH | 7.5 | A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its … | Sep 18, 2026 |
| CVE-2026-93493 | MEDIUM | 5.9 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that … | Sep 18, 2026 |
| CVE-2026-92622 | MEDIUM | 6.4 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due … | Sep 18, 2026 |
| CVE-2026-92554 | MEDIUM | 6.1 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all … | Sep 18, 2026 |
| CVE-2026-92249 | MEDIUM | 6.1 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, … | Sep 18, 2026 |
| CVE-2026-90981 | MEDIUM | 6.1 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up … | Sep 18, 2026 |
| CVE-2026-89059 | HIGH | 7.5 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. … | Sep 18, 2026 |
| CVE-2026-89058 | HIGH | 7.4 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response … | Sep 18, 2026 |
| CVE-2026-85705 | HIGH | 7.5 | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and … | Sep 18, 2026 |
| CVE-2026-85652 | MEDIUM | 6.5 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions … | Sep 18, 2026 |
| CVE-2026-75961 | MEDIUM | 4.9 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up … | Sep 18, 2026 |