CLEANSTART-2026-IV50826 Security fix for CVE-2026-56855 applied in: atlantis 0.47.1-r1, boring-registry 0.18.0-r1, cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.19.6-r4, cert-manager 1.20.3-r5, cert-manager 1.21.1-r1, cosign 2.6.5-r3, dex 2.42.1-r4, dex 2.43.1-r3, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.10.2-r1, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, git-lfs 3.7.1-r3, gitea 1.27.2-r2, go-discover 0_git20250325-r4, haproxy-ingress 0.13.19-r4, haproxy-ingress 0.14.12-r5, haproxy-ingress 0.15.4-r7, haproxy-ingress 0.16.1-r7, helm 3.21.4-r2, helm 4.2.4-r2, keda 2.20.2-r2, knative-serving 1.21.3-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, minio-client 0.20250721.052808-r1, minio-operator 6.0.4-r8, minio-operator 7.0.1-r8, minio-operator 7.1.1-r8, nats-streaming 0.25.6-r7, opa 1.20.2-r2, opentelemetry-collector-contrib 0.157.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-mysqld-exporter 0.17.2-r6, prometheus-mysqld-exporter 0.18.0-r6, prometheus-mysqld-exporter 0.19.0-r5, prometheus-mysqld-exporter 0.20.0-r0, prometheus-node-exporter 1.10.2-r5, prometheus-node-exporter 1.11.1-r4, prometheus-node-exporter 1.12.1-r2, prometheus-node-exporter 1.9.1-r5, prometheus-node-exporter-fips 1.11.1-r3, prometheus-operator 0.90.1-r4, prometheus-operator 0.91.0-r5, prometheus-operator 0.92.1-r3, prometheus-redis-exporter 1.87.0-r2, prometheus-redis-exporter 1.88.0-r3, prometheus-statsd-exporter 0.28.0-r4, prometheus-statsd-exporter 0.29.0-r1, prometheus-statsd-exporter 0.30.0-r0, rclone 1.72.1-r13, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r8, restic-fips 0.18.1-r7, sealed-secrets 0.36.6-r5, sealed-secrets 0.37.0-r3, sealed-secrets 0.38.4-r1, step 0.27.5-r5, step 0.28.7-r6, step 0.29.0-r5, step-issuer 0.10.2-r6, step-issuer 0.11.0-r6, step-issuer 0.9.11-r4, terraform 1.16.0-r2, tigera-operator 1.42.1-r4, trust-manager 0.21.1-r3, trust-manager 0.22.1-r4, trust-manager 0.23.0-r2, trust-manager 0.24.0-r2, vault 1.19.5-r4, vault 1.20.4-r11, vault 1.21.4-r11, vault 2.0.4-r3, vault-k8s 1.4.2-r3, velero 1.15.2-r9, velero 1.17.2-r9, velero 1.18.2-r8, velero-fips 1.18.2-r7, victoriametrics-operator 0.71.0-r3, victoriametrics-operator 0.73.1-r1, victoriametrics-operator-fips 0.71.0-r1

CVE-2026-56855 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-6205

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-40531

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks...

CVE-2026-40532

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13683

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-13639

An insufficient entropy vulnerability in login logic in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13673

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

EUVD-2026-82797

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...