CVE-2026-87801 is a vulnerability in Synology DiskStation Manager (DSM) API framework that allows remote authenticated users to read arbitrary files by inserting sensitive information into sent data. It affects DSM versions before 7.3.2-86009-5 and 7.4.1-90080-1. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-16550 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves external control of file name or path in the Media Parser component, allowing remote authenticated users to write arbitrary files on the system. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-15198 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves missing authentication for critical functionality in the Webdav API, allowing remote attackers to read specific files and perform limited denial-of-service attacks.
CVE-2026-86343 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of CRLF sequences in the SNMP API, allowing remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-75785 is a vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of special elements in OS commands within the VPN API, allowing remote authenticated administrators to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-18633 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting the nfsd component. It involves access of an uninitialized pointer, which can be exploited by remote attackers to cause denial-of-service (DoS) conditions. The issue affects DSM versions prior to 7.3.2-86009-5 and 7.4.1-90080-1. No confidentiality or integrity impact is reported. No known exploits are currently in the wild.
CVE-2026-81584 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper neutralization of special elements in SQL commands within the User API. This flaw allows remote attackers who control a compromised LDAP or Active Directory server to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-19048 is a vulnerability in Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper link resolution before file access in the thumb component, allowing remote authenticated users to write arbitrary files and cause denial-of-service conditions.
CVE-2026-18596 is an authentication bypass vulnerability in Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It affects the OTP mechanism, allowing remote attackers with valid user credentials to bypass authentication via an alternate path or channel. Exploitation can lead to arbitrary file read/write and denial-of-service conditions.
CVE-2026-74857 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves a missing critical step in the authentication process of the Auth API, allowing remote authenticated users to read or write arbitrary files and perform denial-of-service attacks.
Red Hat has issued a security advisory for nginx version 1.24 addressing two vulnerabilities in the ngx_http_core_module. The first is a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176). The second is another unspecified vulnerability in the same module (CVE-2026-97205). These issues affect Red Hat Enterprise Linux 9.8 Extended Update Support and related variants. The advisory rates the update as important and provides updated packages to remediate the vulnerabilities.
CVE-2026-18792 is a vulnerability in Synology DiskStation Manager (DSM) prior to versions 7.3.2-86009-5 and 7.4.1-90080-1. It involves improper limitation of a pathname to a restricted directory in the Sharing API, allowing remote authenticated users to read or write arbitrary files and perform denial-of-service attacks.
CVE-2026-13672 is an authorization bypass vulnerability in Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. It involves a flaw in the SSOAuth component where a user-controlled key allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks. The vulnerability has a high severity with a CVSS score of 8.8.
A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt when parsing LI files. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of the length of user-supplied data before copying it to a heap buffer.
CVE-2026-122044 is an authentication bypass vulnerability in the Philips Hue Bridge Pro HTTP service, which listens on TCP port 443 by default. This flaw allows network-adjacent attackers to bypass authentication without needing credentials due to a failure in applying a protection mechanism. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability.
A stack-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt XE file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a crafted malicious file or visits a malicious page. The vulnerability arises from improper validation of user-supplied data length before copying to a stack buffer.
A use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The flaw arises from improper validation of object existence before operations during XE file parsing.
A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt's AR file parsing functionality. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data length before copying it to a heap buffer.
A use-after-free vulnerability exists in Ashlar-Vellum Cobalt XE file parsing that allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The flaw arises from improper validation of object existence before operations, enabling code execution in the context of the current process.