Threat Intelligence Database

CVE-2026-40539 is a high-severity vulnerability in Synology DiskStation Manager (DSM) affecting the Email API. It involves improper certificate validation that could allow man-in-the-middle attackers to read or write arbitrary files and cause denial-of-service conditions. The issue affects specific versions before the patched releases 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2.

CVE-2026-40534 is a cross-site scripting (XSS) vulnerability in the Video API of Synology DiskStation Manager (DSM) versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. It allows remote authenticated users to read or write limited files when the player is launched. The vulnerability is rated medium severity with a CVSS score of 5.4. No information about patches or vendor advisories is provided in the input.

CVE-2026-40530 is a CRLF injection vulnerability in Synology DiskStation Manager (DSM) affecting versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. It allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks after reboot. The vulnerability requires user authentication and involves improper neutralization of CRLF sequences in the User API.

CVE-2026-13683 is an SQL Injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM). It affects versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The flaw allows remote authenticated users with administrator privileges to obtain non-sensitive information. The vulnerability has a low severity score and does not impact integrity or availability.