CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-21822

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized...

CVE-2026-13673

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-21822 A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized...

CVE-2026-21822 A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized...

CVE-2026-40539

CVE-2026-40539 is an improper certificate validation vulnerability in the Email API component of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . An attacker positioned as a man-in-the-middle can read or write arbitrary files and ...

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

EUVD-2026-82789

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40534

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40530

CVE-2026-40530 is a CRLF injection vulnerability in the User API of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. It allows remote authenticated users to read or write arbitrary files and trigger denial-of-service after a system reboot. The C...

CVE-2026-13623

CVE-2026-13623 is a cross-site scripting (XSS) vulnerability in the Theme API of Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The improper neutralization of input during web page generation allows remote authenticate...

CVE-2026-13623

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

EUVD-2026-82780

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Theme API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write...

CVE-2026-13673

CVE-2026-13673 is an incorrect permission assignment for a critical resource in the LDAP API of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The flaw allows remote authenticated users to read or write arbitrary fil...

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

PT-2026-95327

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper certificate validation issue exists...

EulerOS Virtualization 2.12.1 : perl-Archive-Tar (EulerOS-SA-2026-3604)

According to the versions of the perl-Archive-Tar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction...

RHEL 9 : gstreamer1-plugins-good (RHSA-2026:68642)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68642 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Linux Distros Unpatched Vulnerability : CVE-2026-93201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the G...