CVE-2026-15743

A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The servestatic method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-13639

creationtimestamp| type| source ---|---|--- 2026-09-18 09:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrt45iqpk2y 2026-09-18 09:42:47+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvruwjryii2t 2026-09-18 10:07:23+00:00| seen|...

CVE-2026-67100

creationtimestamp| type| source ---|---|--- 2026-09-18 08:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrqumzmep2f 2026-09-18 09:26:41+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mvrtzrl5mv2l 2026-09-18 10:07:06+00:00| seen|...

CVE-2026-67101

creationtimestamp| type| source ---|---|--- 2026-09-18 08:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvrqukkm2x2j 2026-09-18 10:07:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvrwcbzrnf24 2026-09-18 12:00:29+00:00| seen|...

EUVD-2026-82794

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

EUVD-2026-82791

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40536

CVE-2026-40536 is a path traversal vulnerability in the Audio API of Synology DiskStation Manager (DSM) . Remote authenticated users can access files outside the restricted directory, obtaining non-sensitive information. The flaw is an improper limitation of a pathname to a restricted directory. ...

CVE-2026-40532

Synology DiskStation Manager (DSM) is affected by a forced browsing vulnerability in the Wallpaper Path component, allowing remote authenticated users to obtain sensitive information. The vulnerability affects DSM versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . The CVSS 3.1 s...

EUVD-2026-82781

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

CVE-2026-18911

creationtimestamp| type| source ---|---|--- 2026-09-18 07:04:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvrm4erybj22 2026-09-18 11:11:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvrzul563s2e...

CVE-2026-92714 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2026-92714 Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

CVE-2026-87075

creationtimestamp| type| source ---|---|--- 2026-09-18 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvriuw5kjr24...

CVE-2026-84903

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

CVE-2026-81268

creationtimestamp| type| source ---|---|--- 2026-09-18 05:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvrfjmzovr24...

CVE-2026-80939

creationtimestamp| type| source ---|---|--- 2026-09-18 04:20:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvrcviozu42b 2026-09-18 04:20:06+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117290120270390690...

CVE-2026-84859

creationtimestamp| type| source ---|---|--- 2026-09-18 04:00:09+00:00| seen| Telegram/YI-zyM6R2SXtebw0qilHuEbC29iP0vy8Cn8zxh5ugjaAgA 2026-09-19 00:00:24+00:00| published-proof-of-concept| Telegram/YI-zyM6R2SXtebw0qilHuEbC29iP0vy8Cn8zxh5ugjaAgA...