CVE-2026-111436 is a memory leak vulnerability in the openEuler iSulad daemon affecting versions up to 2.1.6. The flaw occurs in the src/daemon/modules/spec/specs_mount.c file, where memory is not properly released after its effective lifetime. This leads to frequent triggering of the iSulad daemon, exhausting system memory and causing an out-of-memory (OOM) crash, resulting in a denial of service (DoS).
CVE-2026-111435 is a relative path traversal vulnerability in the openEuler iSulad container runtime on Linux. The flaw exists in the oci_load_process_manifest() function within the oci_load.c source file, where the Config path of manifest.json is not properly sanitized. This allows a maliciously crafted tar package to cause iSulad, running with root privileges, to read arbitrary files on the host system. The vulnerability affects iSulad versions up to and including 2.1.6.
A security vulnerability in Vim (Vi IMproved) allows arbitrary code execution due to a Vimscript injection via an unescaped filename in the netrw s:NetrwMarkFile() filter() expression. This issue is tracked as CVE-2026-43961 and affects Red Hat Enterprise Linux 9.8 Extended Update Support versions. Red Hat has released an update addressing this vulnerability along with other bug fixes and enhancements.
CVE-2026-111434 is a format string vulnerability in openEuler iSulad versions up to 2.1.6. The issue occurs when the iSulad daemon reads stderr output from the isula runtime shim process during container lifecycle operations. If this output contains format specifiers, it may lead to information leakage, denial of service, or arbitrary write risks.
CVE-2026-111433 is a UNIX symbolic link (symlink) following vulnerability in the openEuler iSulad container runtime up to version 2.1.6. An attacker who can get a victim or platform to run a crafted malicious container image may cause the iSulad daemon to copy sensitive host directories into an anonymous volume during container creation, allowing the container to read these host directories.
CVE-2026-76954 is a critical vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. It involves improper neutralization of special elements in SQL commands within the Auth API, allowing remote attackers to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-85101 is an authentication bypass vulnerability in the rsync component of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. This flaw allows remote attackers to bypass authentication using an alternate path or channel, enabling them to read specific files, write arbitrary files, and perform limited denial-of-service attacks.
CVE-2026-88266 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. It allows remote authenticated users to write specific files via the synomount component, potentially leading to unauthorized configuration changes. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-81559 is a missing authorization vulnerability in the TaskScheduler API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-81558 is a medium-severity vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves missing authorization in the SocketIo API, allowing remote authenticated users to write specific files.
CVE-2026-77738 is a server-side request forgery (SSRF) vulnerability in the Credential API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It allows remote authenticated users to read specific files on the system. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-74850 is a medium severity vulnerability in Synology DiskStation Manager (DSM) prior to versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper limitation of a pathname to a restricted directory in the contentextract component, allowing remote authenticated users to read specific files they should not have access to.
CVE-2026-19414 is a missing authorization vulnerability in the Promotion API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-85098 is a reachable assertion vulnerability in the synoscgi component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to cause limited denial-of-service (DoS) conditions. The vulnerability does not impact confidentiality or integrity but affects availability. It has a CVSS 3.1 base score of 5.3, indicating medium severity.
CVE-2026-124993 is an incorrect authorization vulnerability in the Security Advisor component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to read specific files without proper authorization. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.
CVE-2026-92379 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the Notification API, allowing remote authenticated users to read or write specific files. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-81557 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of input during web page generation in the DSMNotify component. This flaw allows remote authenticated users to read or write specific files on the system.
CVE-2026-19833 is a missing authorization vulnerability in the ACL API of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote authenticated users to read or write specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.4.
CVE-2026-13656 is a medium severity vulnerability in Synology DiskStation Manager (DSM) affecting the Audio Player component. It involves improper neutralization of input during web page generation, allowing remote authenticated users to read or write specific files. The issue affects DSM versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. The vulnerability requires user authentication and user interaction to exploit and impacts confidentiality and integrity with no availability impact.
CVE-2026-15201 is a medium severity vulnerability in Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper certificate validation in the Support Form feature, which could allow man-in-the-middle attackers to read arbitrary files and write specific files during support form submission.