Exploit for CVE-2026-75827

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-6205

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40535

CVE-2026-40535 is a path traversal vulnerability in the Desktop API component of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . The improper limitation of a pathname to a restricted directory allows remote attackers (no privileg...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

EUVD-2026-82785

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

CVE-2026-40530

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

EUVD-2026-82779

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

CVE-2026-13666

CVE-2026-13666 is a CRLF Injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM) . A remote authenticated user can write limited files when a victim clicks a crafted sharing URL. The CVSS 3.1 score is 3.5 (Low) with the vector requiring network access, low complexity, low...

CVE-2026-13666

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

CVE-2026-13666

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

CVE-2026-6205

CVE-2026-6205 is an external control of file name or path vulnerability in the Upload API of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. It allows remote authenticated users to write arbitrary files and conduct denial-of-servic...

EUVD-2026-82772

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

OPENSUSE-SU-2026:21874-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-67322: environment-variable exfiltration in Repo.clonefrom URL via os.path.expandvars bsc1273357. - CVE-2026-67323: unguarded Git options passed as keyword arguments in Repo.archive and git.lsremote allow for command injectio...

CVE-2026-40539: Improper Certificate Validation

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

PT-2026-95323

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A path traversal issue exists in the Desktop AP...

PT-2026-95314

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...