CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-9548

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

EUVD-2026-67463

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

CVE-2026-9548

Synology Chat Server versions prior to 2.4.5-22148 are affected by a Cross-Site Scripting (XSS) vulnerability in the extract domain function, caused by improper neutralization of input during web page generation. A remote authenticated user with low privileges can exploit this via a UI interactio...

CVE-2026-9548

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

EUVD-2026-67462

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-9491

A Server-Side Request Forgery (SSRF) vulnerability in the webhook component of Synology Chat Server prior to 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information. The CVSS v3.1 score is 4.3 (Medium) with a network attack vector, low complexity, and low privileges requ...

CVE-2026-9491

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-9491

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

Synology Chat Server before 2.4.5-22148 contains an improper input neutralization vulnerability in the extract domain component, classified as a cross-site scripting (XSS) flaw. Remote authenticated users can, through a UI interaction, read or write arbitrary files and trigger denial-of-service a...

EUVD-2026-67461

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

PT-2026-83259

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A race condition exists in Copilot Chat, where concurrent execution using a shared resource with improper synchronization allows an authorized attacker to disclose information over a...

PT-2026-83027

CVE ID: CVE-2026-9548 Severity: MEDIUM | CVSS Score: 6.5/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. An improper neutralization of input during web page generation 'Cross-site Scripting'...

PT-2026-83026

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-9548: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

PT-2026-83307

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chat id/history, DELETE /chat/chat id, and POST /chat/chat id/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-58616: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

PT-2026-83304

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select conv, delete conv, rename conv, and on set public conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary...