CVE-2026-92379

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-74850

An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files...

CVE-2026-19833

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-85101

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited...

CVE-2026-85101

Synology DiskStation Manager (DSM) is affected by an authentication bypass vulnerability in the rsync component (CWE-288) prior to versions 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to read specific files , write arbitrary files , and perf...

CVE-2026-77738

A server-side request forgery (SSRF) vulnerability exists in the Credential API of Synology DiskStation Manager (DSM) . This flaw affects versions prior to 7.3.2-86009-5 and 7.4.1-90080-1 . It allows remote authenticated users to read specific files on the system. No specific exploit code or expl...

EUVD-2026-124201

A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files...

CVE-2026-74850

Synology DiskStation Manager (DSM) is vulnerable to an improper limitation of a pathname to a restricted directory in the contentextract component. This flaw allows remote authenticated users to read specific files. The vulnerability impacts versions before 7.3.2-86009-5 and 7.4.1-90080-1 . No sp...

CVE-2026-92379

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124196

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124195

An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-19833

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124194

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of input during web page generation in the Audio Player component. This vulnerability allows remote authenticated users to read or write specific files . Remediation is ...

EUVD-2026-124193

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124189

A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks...

Munin munin-httpd 2.99.1-2.999.18 - Unauthenticated Path Traversal

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal caused by improper '/../' substring check in static file handler Munin::Master::HTML::handlerequest, letting unauthenticated attackers read files outside the static directory. id: CVE-2026-125357 info: name: Munin munin-httpd...

PT-2026-145697

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...