EUVD-2026-124538

MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious modelid parameter to the log outputs API. Attackers can exploit the unvalidated modelid...

CVE-2026-92379

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-81559

A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

CVE-2026-19833

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-85101

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited...

CVE-2026-85101

Synology DiskStation Manager (DSM) is affected by an authentication bypass vulnerability in the rsync component (CWE-288) prior to versions 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to read specific files , write arbitrary files , and perf...

EUVD-2026-124252

An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

CVE-2026-81559

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected by a missing authorization vulnerability in the TaskScheduler API . This flaw allows remote authenticated users to write specific files. Remediation is available in the updated versions; specific patch...

CVE-2026-92379

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124196

An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124195

An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-19833

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124194

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of input during web page generation in the Audio Player component. This vulnerability allows remote authenticated users to read or write specific files . Remediation is ...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124193

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

PT-2026-145690

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

PT-2026-145696

An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

PT-2026-145684

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...