PT-2026-95322

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper neutralization of input during web...

CVE-2026-40535: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40534: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-4036: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-13623: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-13666: Improper Neutralization of CRLF Sequences

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

PT-2026-95327

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper certificate validation issue exists...

CVE-2025-14753: Improper Limitation of a Pathname to a Restricted Directory

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-91205: Race Condition Enabling Link Following

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link symlink before the ownership change...

PT-2026-95284

Name of the Vulnerable Software and Affected Versions Printcart Web to Print Product Designer for WooCommerce versions prior to 2.8.6 Description This issue involves a Directory Traversal flaw that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing...

PT-2026-95288

Name of the Vulnerable Software and Affected Versions The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers versions prior to 2.8.1 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can read arbitrary...

PT-2026-95718

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The application uses a calculator-style vault passcode to protect access, but the stored data is not bound to this authentication boundary. A local actor with...

PT-2026-95636

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A race condition exists during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory wit...

CVE-2026-91203: Race Condition Enabling Link Following

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

PT-2026-95634

Name of the Vulnerable Software and Affected Versions cockpit-files versions prior to 44-1.1 Description A flaw in the "Paste as owner" function allows a low-privileged local user to change arbitrary file ownership outside the intended directory. This is achieved by crafting a directory containin...

CVE-2026-91202: UNIX Symbolic Link (Symlink) Following

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

CVE-2026-54237

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

MAL-2026-16264 Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

AZL-101948 CVE-2026-93051 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...