CVE-2026-77738 is a server-side request forgery (SSRF) vulnerability in the Credential API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It allows remote authenticated users to read specific files on the system. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-74850 is a medium severity vulnerability in Synology DiskStation Manager (DSM) prior to versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper limitation of a pathname to a restricted directory in the contentextract component, allowing remote authenticated users to read specific files they should not have access to.
CVE-2026-19414 is a missing authorization vulnerability in the Promotion API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-85098 is a reachable assertion vulnerability in the synoscgi component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to cause limited denial-of-service (DoS) conditions. The vulnerability does not impact confidentiality or integrity but affects availability. It has a CVSS 3.1 base score of 5.3, indicating medium severity.
CVE-2026-124993 is an incorrect authorization vulnerability in the Security Advisor component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to read specific files without proper authorization. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.
CVE-2026-92379 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the Notification API, allowing remote authenticated users to read or write specific files. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-81557 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the DSMNotify component. This flaw allows remote authenticated users to read or write specific files on the system.
CVE-2026-19833 is a missing authorization vulnerability in the ACL API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read or write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.4.
CVE-2026-13656 is a medium severity vulnerability in Synology DiskStation Manager (DSM) affecting the Audio Player component. It involves improper neutralization of input during web page generation, allowing remote authenticated users to read or write specific files. The issue affects DSM versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. The vulnerability requires user authentication and user interaction to exploit and impacts confidentiality and integrity with no availability impact.
CVE-2026-15201 is a medium severity vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper certificate validation in the Support Form feature, which could allow man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.
CVE-2026-87801 is a vulnerability in Synology DiskStation Manager (DSM) API framework that allows remote authenticated users to read arbitrary files by inserting sensitive information into sent data. It affects DSM versions before 7.3.2-86009-5 and 7.4.1-90080-1. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-16550 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves external control of file name or path in the Media Parser component, allowing remote authenticated users to write arbitrary files on the system. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-15198 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves missing authentication for critical functionality in the Webdav API, allowing remote attackers to read specific files and perform limited denial-of-service attacks.
CVE-2026-86343 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of CRLF sequences in the SNMP API, allowing remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-75785 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of special elements in OS commands within the VPN API, allowing remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-18633 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting the nfsd component. It involves access of an uninitialized pointer, which can be exploited by remote attackers to cause denial-of-service (DoS) conditions. The issue affects DSM versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. No confidentiality or integrity impact is reported. No known exploits are currently in the wild.
Two security vulnerabilities affecting nginx 1.26 have been addressed in a Red Hat Enterprise Linux 9.8 Extended Update Support release. The first is a heap-based buffer overflow in the ngx_http_core_module triggered via alias with rewrite referencing $request_filename (CVE-2026-15176). The second is another vulnerability in the same module (CVE-2026-97205). These issues could impact the stability and security of nginx web and proxy servers. Red Hat has issued an important security update to fix these flaws.
CVE-2026-81584 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of special elements in SQL commands within the User API. This flaw allows remote attackers who control a compromised LDAP or Active Directory server to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-19048 is a vulnerability in Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper link resolution before file access in the thumb component, allowing remote authenticated users to write arbitrary files and cause denial-of-service conditions.
CVE-2026-18596 is an authentication bypass vulnerability in Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It affects the OTP mechanism, allowing remote attackers with valid user credentials to bypass authentication via an alternate path or channel. Exploitation can lead to arbitrary file read/write and denial-of-service conditions.