2026

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups func

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to imp

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php fil

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry fu

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest funct

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager

An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary

An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local use

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox -

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Fr

An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0

Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbi

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functional

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStati

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Syn

Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-

Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station befo

Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Stati

Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functiona

Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for des

Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13

The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc

The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerab

The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso'

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribut

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection vi

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including,

Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cro

AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every re

When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view d

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view u

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset funct

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset funct

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID funct

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task du

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevic

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles fu

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAcc

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues funct

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues funct