Synology PSIRT (product security advisories)

synology-security-advisories · A · candidate

https://www.synology.com/security/advisory

vendor-psirtvulnslang: enfetch failures: 0quiet periods: 0last fetch: 2026-10-25

Added 2026-10-25 (2026-10-25T1308Z-audit), G1 re-sweep: Synology's product security advisories; Synology-SA-26:14 (PHP2Shell packages, 2026-10-22) reached no fire. `extract https://www.synology.com/security/advisory/<id>` reads the advisory with its fixed-release table.

Cited in 2 entries

Citation cadence

Citation days per ISO week (5 weeks of coverage span, total 2).

CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, other QNAP products still unfixed2026-10-25
CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials2026-09-22