CVE-2026-92714 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-13882 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow an unauthenticated user to cause a denial of service in the email service due to improper control...

CLEANSTART-2026-HJ35817 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the cert-manager package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-OM94808 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-KC15122 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the cert-manager package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

CLEANSTART-2026-DK21995 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the cert-manager package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

PT-2026-95326

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper restriction of excessive...

PT-2026-95323

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A path traversal issue exists in the Desktop AP...

PT-2026-95319

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An integer overflow or wraparound issue exists ...

PT-2026-95322

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper neutralization of input during web...

PT-2026-95316

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95286

Name of the Vulnerable Software and Affected Versions FileBird – WordPress Media Library Folders & File Manager versions prior to 6.5.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access and...

PT-2026-95325

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A server-side request forgery SSRF issue exists...

PT-2026-95321

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A sensitive information exposure issue exists...

PT-2026-95327

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper certificate validation issue exists...

PT-2026-95311

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-100027

Security vulnerability affects the cert-manager-webhook-pdns-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-40534: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-13684: Improper Encoding or Escaping of Output

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13683: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...