CVE-2026-40532

Synology DiskStation Manager (DSM) is affected by a forced browsing vulnerability in the Wallpaper Path component, allowing remote authenticated users to obtain sensitive information. The vulnerability affects DSM versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . The CVSS 3.1 s...

CVE-2026-40531

An integer overflow or wraparound vulnerability in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service . Affected versions are before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86057-2 (note: documents list 7....

CVE-2026-4036

CVE-2026-4036 is an SQL injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM), affecting versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . A remote authenticated user can exploit it to obtain arbitrary sharing files . The CVSS 3.1 score is 6.5 (MEDIUM...

CVE-2026-40530

CVE-2026-40530 is a CRLF injection vulnerability in the User API of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. It allows remote authenticated users to read or write arbitrary files and trigger denial-of-service after a system reboot. The C...

CVE-2026-56595

HCL BigFix Service Management is affected by a CORS misconfiguration caused by improperly validated origin headers. An attacker can craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a vic...

CVE-2026-56597

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability that allows an unauthenticated attacker to extract internal IP addresses from the application's responses. This enables the attacker to map the underlying network topology and identify potential internal ta...

CVE-2026-56592

HCL BigFix Service Management is affected by an Improper Authentication vulnerability caused by inadequate account lockout mechanisms. An unauthenticated attacker can execute sustained brute-force attacks against the login interface, potentially achieving unauthorized system access . The CVSS v3....

CVE-2026-13683

CVE-2026-13683 is a SQL Injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The flaw arises from improper neutralization of special elements in SQL commands. Exploitati...

CVE-2026-13623

CVE-2026-13623 is a cross-site scripting (XSS) vulnerability in the Theme API of Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The improper neutralization of input during web page generation allows remote authenticate...

CVE-2026-13666

CVE-2026-13666 is a CRLF Injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM) . A remote authenticated user can write limited files when a victim clicks a crafted sharing URL. The CVSS 3.1 score is 3.5 (Low) with the vector requiring network access, low complexity, low...

CVE-2026-56590

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability caused by improper file validation controls. An unauthenticated attacker can upload and execute malicious payloads, potentially leading to complete server compromise . The CNA-assigned CVSS 3.1 score is 6.4 (ME...

CVE-2026-6205

CVE-2026-6205 is an external control of file name or path vulnerability in the Upload API of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. It allows remote authenticated users to write arbitrary files and conduct denial-of-servic...

CVE-2026-13673

CVE-2026-13673 is an incorrect permission assignment for a critical resource in the LDAP API of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The flaw allows remote authenticated users to read or write arbitrary fil...

CVE-2026-13635

Synology DiskStation Manager (DSM) contains an improper encoding or escaping of output vulnerability in the Auth API . Remote attackers without authentication can exploit this flaw to obtain non-sensitive information from affected versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, an...

CVE-2026-13639

Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 is affected by an insufficient entropy vulnerability in its login logic . A remote, unauthenticated attacker can leverage this flaw to read or write arbitrary files and conduct denial-of...

CVE-2026-21848

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability stemming from improper access controls. An authenticated attacker with low privileges can exploit this to view restricted data elements across tenant boundaries , indicating a cross-tenant information disclosur...

CVE-2026-13684

CVE-2026-13684 is an improper encoding or escaping of output vulnerability in the SCGI component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 . The flaw allows remote, unauthenticated attackers to read or write arbitrary files...

CVE-2026-11757

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the KA Informatics Technologies Ltd. Co. Bar Association Website , caused by improper neutralization of input during web page generation. The affected version range extends through 18/09/2026 . The CVSS 3.1 score is 6.1 (MEDIUM) , wit...

CVE-2026-93493

CVE-2026-93493 affects Netty's netty-handler-ssl-ocsp component. The flaw is in OCSP certificate validation: when a remote attacker supplies an OCSP response that omits the optional nextUpdate field, the validation is silently skipped , causing the application to proceed with an unvalidated certi...

CVE-2026-67103

HCL BigFix Service Management is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject unsanitized malicious scripts executed in a victim's browser. The stated impact includes session hijacking , account takeover , and unauthorized actions on behalf of affected ...