Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26387
Total
1955
Critical
7970
High
8222
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-40841 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40840 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40839 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40838 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40837 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40836 | HIGH | 7.1 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40835 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40834 | HIGH | 7.1 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40833 | HIGH | 7.1 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40832 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40831 | MEDIUM | 6.5 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40830 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40829 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40828 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40827 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-2237 | MEDIUM | 6.2 | A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local attackers to … | May 27, 2026 |
| CVE-2025-66593 | MEDIUM | 6.1 | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content during installation. | May 27, 2026 |
| CVE-2025-66592 | MEDIUM | 6.1 | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content during … | May 27, 2026 |
| CVE-2025-52747 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Reflected XSS. This issue affects Themebox … | May 27, 2026 |
| CVE-2025-30028 | HIGH | 8.6 | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | May 27, 2026 |
| CVE-2025-22741 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS. This issue affects Felan Framework: from n/a … | May 27, 2026 |
| CVE-2025-14713 | HIGH | 7.5 | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials … | May 27, 2026 |
| CVE-2025-13593 | MEDIUM | 6.1 | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content when installing. | May 27, 2026 |
| CVE-2025-13392 | HIGH | 8.1 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote … | May 27, 2026 |
| CVE-2025-13167 | MEDIUM | 5.4 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read … | May 27, 2026 |