Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26387
Total
1955
Critical
7970
High
8222
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-12686 | CRITICAL | 9.8 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary … | May 27, 2026 |
| CVE-2025-10466 | MEDIUM | 5.9 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with … | May 27, 2026 |
| CVE-2024-47272 | LOW | 2.7 | Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file … | May 27, 2026 |
| CVE-2024-47271 | MEDIUM | 4.9 | Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive … | May 27, 2026 |
| CVE-2024-47270 | LOW | 2.7 | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to … | May 27, 2026 |
| CVE-2024-47269 | MEDIUM | 4.9 | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges … | May 27, 2026 |
| CVE-2024-47268 | MEDIUM | 4.9 | Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information … | May 27, 2026 |
| CVE-2024-47267 | LOW | 2.7 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows … | May 27, 2026 |
| CVE-2024-11399 | MEDIUM | 6.8 | Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks … | May 27, 2026 |
| CVE-2023-52945 | HIGH | 7.8 | Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified … | May 27, 2026 |
| CVE-2026-8942 | MEDIUM | 4.3 | The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to … | May 27, 2026 |
| CVE-2026-8906 | MEDIUM | 6.1 | The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing … | May 27, 2026 |
| CVE-2026-8832 | HIGH | 8.8 | The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in … | May 27, 2026 |
| CVE-2026-8143 | HIGH | 7.2 | The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters in all versions up to, and including, … | May 27, 2026 |
| CVE-2026-8042 | MEDIUM | 6.4 | The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up … | May 27, 2026 |
| CVE-2026-7618 | MEDIUM | 4.9 | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, … | May 27, 2026 |
| CVE-2026-6169 | HIGH | 7.2 | The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin … | May 27, 2026 |
| CVE-2026-49001 | MEDIUM | 5.3 | Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as … | May 27, 2026 |
| CVE-2026-41704 | MEDIUM | 5.0 | AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response['value']['result']['compile_log_id'] (line 332-338) and passes it to download_and_delete_blob. … | May 27, 2026 |
| CVE-2026-41009 | MEDIUM | 5.8 | When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line … | May 27, 2026 |
| CVE-2026-40826 | MEDIUM | 4.9 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40825 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40824 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutralization of special elements … | May 27, 2026 |
| CVE-2026-40823 | MEDIUM | 5.5 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a … | May 27, 2026 |
| CVE-2026-40822 | MEDIUM | 4.9 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a … | May 27, 2026 |