{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/diskstation-manager--7.2.1-69057-13--7.2.2-72806-10--7.3.2-86009-5--7.4.1-90080-1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-76954"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DiskStation Manager (\u003c 7.2.1-69057-13, \u003c 7.2.2-72806-10, \u003c 7.3.2-86009-5, \u003c 7.4.1-90080-1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Synology"],"content_html":"\u003cp\u003eSynology DiskStation Manager (DSM) contains an improper neutralization of special elements used in an SQL command vulnerability (CVE-2026-76954) within the Auth API. This vulnerability allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can result in the ability to read or write arbitrary files and conduct denial-of-service attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eApply updates provided by the vendor to remediate the vulnerability.\u003c/p\u003e\n","date_modified":"2026-11-12T09:30:13Z","date_published":"2026-11-12T09:30:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-76954/","summary":"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API of Synology DiskStation Manager (DSM) allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.","title":"Synology DiskStation Manager: Auth API SQL Injection (CVE-2026-76954)","url":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-sqli-cve-2026-76954/"}],"language":"en","title":"CraftedSignal Threat Feed - DiskStation Manager (\u003c 7.2.1-69057-13, \u003c 7.2.2-72806-10, \u003c 7.3.2-86009-5, \u003c 7.4.1-90080-1)","version":"https://jsonfeed.org/version/1.1"}