CVE-2026-81942 PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

EUVD-2026-82791

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

CVE-2026-40536 is a path traversal vulnerability in the Audio API of Synology DiskStation Manager (DSM) . Remote authenticated users can access files outside the restricted directory, obtaining non-sensitive information. The flaw is an improper limitation of a pathname to a restricted directory. ...

CVE-2026-13666

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL...

EUVD-2026-82777

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

PT-2026-95632

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A missing authorization check in the REST API allows a remote authenticated attacker to gain elevated privileges. Recommendations At the moment, there is no information about a newer versio...

CVE-2026-4036: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-40537: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40534: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40531: Integer Overflow or Wraparound

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks...

CVE-2026-13623: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-81942: Improper Neutralization of Special Elements used in an OS Command

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

CVE-2026-81944: Stack-based Buffer Overflow

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of...

CVE-2026-84074: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84064: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84036: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-84239: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...