CVE-2026-13623

CVE-2026-13623 is a cross-site scripting (XSS) vulnerability in the Theme API of Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The improper neutralization of input during web page generation allows remote authenticate...

CVE-2026-13666

CVE-2026-13666 is a CRLF Injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM) . A remote authenticated user can write limited files when a victim clicks a crafted sharing URL. The CVSS 3.1 score is 3.5 (Low) with the vector requiring network access, low complexity, low...

CVE-2026-56590

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability caused by improper file validation controls. An unauthenticated attacker can upload and execute malicious payloads, potentially leading to complete server compromise . The CNA-assigned CVSS 3.1 score is 6.4 (ME...

CVE-2026-6205

CVE-2026-6205 is an external control of file name or path vulnerability in the Upload API of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. It allows remote authenticated users to write arbitrary files and conduct denial-of-servic...

CVE-2026-13673

CVE-2026-13673 is an incorrect permission assignment for a critical resource in the LDAP API of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The flaw allows remote authenticated users to read or write arbitrary fil...

CVE-2026-13635

Synology DiskStation Manager (DSM) contains an improper encoding or escaping of output vulnerability in the Auth API . Remote attackers without authentication can exploit this flaw to obtain non-sensitive information from affected versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, an...

CVE-2026-13639

Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 is affected by an insufficient entropy vulnerability in its login logic . A remote, unauthenticated attacker can leverage this flaw to read or write arbitrary files and conduct denial-of...

CVE-2026-21848

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability stemming from improper access controls. An authenticated attacker with low privileges can exploit this to view restricted data elements across tenant boundaries , indicating a cross-tenant information disclosur...

CVE-2026-13684

CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the SCGI component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 . The flaw allows remote, unauthenticated attackers to read or write arbitrary files...

CVE-2026-11757

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the KA Informatics Technologies Ltd. Co. Bar Association Website , caused by improper neutralization of input during web page generation. The affected version range extends through 18/09/2026 . The CVSS 3.1 score is 6.1 (MEDIUM) , wit...

CVE-2026-93493

CVE-2026-93493 affects Netty's netty-handler-ssl-ocsp component. The flaw is in OCSP certificate validation: when a remote attacker supplies an OCSP response that omits the optional nextUpdate field, the validation is silently skipped , causing the application to proceed with an unvalidated certi...

CVE-2026-67103

HCL BigFix Service Management is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject unsanitized malicious scripts executed in a victim's browser. The stated impact includes session hijacking , account takeover , and unauthorized actions on behalf of affected ...

CVE-2026-67102

HCL BigFix Service Management is affected by a Broken Access Control vulnerability that allows a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. The CVSS v3.1 score is 8.1 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-67100

HCL BigFix Service Management is affected by two vulnerabilities: a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. An attacker can inject database commands to extract sensitive system details and manipulate request values to gain unauthorized access to full personal profile data and PI...

CVE-2026-75157

Apache Airflow contains an authorization flaw in its asset queued-events DELETE endpoints , which checked the caller's Dag-axis permission as READ instead of EDIT. Any authenticated user with read access to a Dag could delete that Dag's queued asset events, silently suppressing asset-triggered sc...

CVE-2026-67101

HCL BigFix Service Management is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its search functionality . An attacker can exploit this to force the application server to send requests to internal systems that are otherwise inaccessible from the internet, with high confidentiality and...

CVE-2026-12384

CVE-2026-12384 is an authorization bypass through a user-controlled key in the TECHIN2B Application , enabling privilege abuse . The affected version range is V1.0.7676.13 through 18092026 . The vulnerability is categorized as Broken Access Control and carries a CVSS 3.1 base score of 8.8 (HIGH) ...

CVE-2026-92249

Qi Addons For Elementor (WordPress plugin) versions up to and including 1.11 are vulnerable to Reflected DOM-Based Cross-Site Scripting via the s search parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute ...

CVE-2026-85705

The Location Manager plugin for WordPress (up to and including version 2.3.38) is vulnerable to unauthenticated SQL injection via the latitude and longitude REST API parameters. The root cause is insufficient escaping of user-supplied parameters combined with inadequate preparation of the existin...

CVE-2026-85652

The Photo Gallery by 10Web WordPress plugin (all versions up to and including 1.8.44 ) is vulnerable to time-based SQL injection via the album_id shortcode attribute. The root cause is insufficient escaping of the user-supplied parameter combined with a lack of prepared statements in the underlyi...