CVE Watch12 nov 2026

CVE-2026-87801

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-8

CVSS

6.5

Medio

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-201

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.

Referencias oficiales

www.synology.comhttps://www.synology.com/en-global/security/advisory/Synology_SA_26_18

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-126331—

—

——0Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.1d CVE-2026-1257675.3 MED

—

——0Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.1d CVE-2026-1257665.3 MED

—

——0Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.1d CVE-2026-1254355.3 MED

—

——0Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.1d CVE-2026-1257775.3 MED

—

——0Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.9h CVE-2026-1216746.1 MED

53.9%

——16Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.2d