2026 CVE Vulnerabilities
67,491 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-40538 | LOW | 3.7 | — | Sep 18, 2026 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager... |
| CVE-2026-40537 | MEDIUM | 4.3 | — | Sep 18, 2026 | A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-... |
| CVE-2026-40536 | MEDIUM | 4.3 | — | Sep 18, 2026 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology... |
| CVE-2026-40535 | MEDIUM | 6.5 | — | Sep 18, 2026 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synolo... |
| CVE-2026-40534 | MEDIUM | 5.4 | — | Sep 18, 2026 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Sy... |
| CVE-2026-40533 | MEDIUM | 5.3 | — | Sep 18, 2026 | An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (... |
| CVE-2026-40532 | MEDIUM | 6.5 | — | Sep 18, 2026 | A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-... |
| CVE-2026-40531 | MEDIUM | 4.3 | — | Sep 18, 2026 | An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-690... |
| CVE-2026-40530 | HIGH | 8 | — | Sep 18, 2026 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manage... |
| CVE-2026-21848 | MEDIUM | 5 | — | Sep 18, 2026 | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticat... |
| CVE-2026-21822 | MEDIUM | 6.3 | — | Sep 18, 2026 | HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handl... |
| CVE-2026-13684 | CRITICAL | 9.8 | — | Sep 18, 2026 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-6905... |
| CVE-2026-13683 | LOW | 2.7 | — | Sep 18, 2026 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler ... |
| CVE-2026-13673 | HIGH | 8.8 | — | Sep 18, 2026 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM)... |
| CVE-2026-13666 | LOW | 3.5 | — | Sep 18, 2026 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Man... |
| CVE-2026-13639 | CRITICAL | 9.8 | — | Sep 18, 2026 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-... |
| CVE-2026-13635 | MEDIUM | 5.3 | — | Sep 18, 2026 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-... |
| CVE-2026-13623 | MEDIUM | 4.8 | — | Sep 18, 2026 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Sy... |
| CVE-2026-93494 | HIGH | 7.5 | 0.6% | Sep 18, 2026 | A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending ... |
| CVE-2026-93493 | MEDIUM | 5.9 | — | Sep 18, 2026 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by prov... |
| CVE-2026-92622 | MEDIUM | 6.4 | — | Sep 18, 2026 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode... |
| CVE-2026-92554 | MEDIUM | 6.1 | 0.3% | Sep 18, 2026 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflecte... |
| CVE-2026-92249 | MEDIUM | 6.1 | 0.3% | Sep 18, 2026 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter i... |
| CVE-2026-90981 | MEDIUM | 6.1 | — | Sep 18, 2026 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
| CVE-2026-89059 | HIGH | 7.5 | — | Sep 18, 2026 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now