CVE-2026-67100

creationtimestamp| type| source ---|---|--- 2026-09-18 08:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrqumzmep2f 2026-09-18 09:26:41+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvrtzrl5mv2l 2026-09-18 10:07:06+00:00| seen|...

CVE-2026-67101

creationtimestamp| type| source ---|---|--- 2026-09-18 08:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrqukkm2x2j 2026-09-18 10:07:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvrwcbzrnf24 2026-09-18 12:00:29+00:00| seen|...

EUVD-2026-82794

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

EUVD-2026-82791

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

CVE-2026-40536 is a path traversal vulnerability in the Audio API of Synology DiskStation Manager (DSM) . Remote authenticated users can access files outside the restricted directory, obtaining non-sensitive information. The flaw is an improper limitation of a pathname to a restricted directory. ...

CVE-2026-40532

Synology DiskStation Manager (DSM) is affected by a forced browsing vulnerability in the Wallpaper Path component, allowing remote authenticated users to obtain sensitive information. The vulnerability affects DSM versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . The CVSS 3.1 s...

EUVD-2026-82781

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

CVE-2026-18911

creationtimestamp| type| source ---|---|--- 2026-09-18 07:04:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvrm4erybj22 2026-09-18 11:11:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvrzul563s2e...

CVE-2026-92714 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2026-92714 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2026-87075

creationtimestamp| type| source ---|---|--- 2026-09-18 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvriuw5kjr24...

CVE-2026-84903

King Addons for Elementor is a WordPress plugin that, in versions before 51.1.81 , fails to perform any capability, post-status, or password check before rendering the content of a user-supplied post via the kng_maintenance_page shortcode. This allows any user with Contributor-level access or abo...

CVE-2026-81268

creationtimestamp| type| source ---|---|--- 2026-09-18 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvrfjmzovr24...

CVE-2026-80939

creationtimestamp| type| source ---|---|--- 2026-09-18 04:20:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvrcviozu42b 2026-09-18 04:20:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117290120270390690...

CVE-2026-84859

creationtimestamp| type| source ---|---|--- 2026-09-18 04:00:09+00:00| seen| Telegram/YI-zyM6R2SXtebw0qilHuEbC29iP0vy8Cn8zxh5ugjaAgA 2026-09-19 00:00:24+00:00| published-proof-of-concept| Telegram/YI-zyM6R2SXtebw0qilHuEbC29iP0vy8Cn8zxh5ugjaAgA...

CVE-2022-38725

creationtimestamp| type| source ---|---|--- 2026-09-18 04:00:08+00:00| seen| Telegram/fjZvNReB1UWIVjHq7mUHd7jlExE07it3dmo5byOyMue5zSk 2026-09-19 00:00:25+00:00| published-proof-of-concept| Telegram/fjZvNReB1UWIVjHq7mUHd7jlExE07it3dmo5byOyMue5zSk...

CVE-2025-25347

creationtimestamp| type| source ---|---|--- 2026-09-18 04:00:08+00:00| seen| Telegram/fjZvNReB1UWIVjHq7mUHd7jlExE07it3dmo5byOyMue5zSk 2026-09-19 00:00:25+00:00| published-proof-of-concept| Telegram/fjZvNReB1UWIVjHq7mUHd7jlExE07it3dmo5byOyMue5zSk...

CVE-2026-44246

creationtimestamp| type| source ---|---|--- 2026-09-18 04:00:07+00:00| seen| Telegram/UVRhJ-dfvv69hp5StkOgcAC9P7rtS8qZd-pCJe4m6gUHuNs 2026-09-19 00:00:26+00:00| published-proof-of-concept| Telegram/UVRhJ-dfvv69hp5StkOgcAC9P7rtS8qZd-pCJe4m6gUHuNs...