September 19, 2026
- Two unauthenticated CVSS 9.8 file read/write bugs in Synology DSM — CVE-2026-13684 (improper encoding/escaping in SCGI) and CVE-2026-13639 (insufficient entropy in login logic) — affect DSM 7.4, 7.3, 7.2.2 and 7.2.1 with no workarounds listed (Synology-SA-26:13). IBM separately patched a cluster of criticals in Guardium Data Protection 12.2, including CVE-2026-82340, an unauthenticated deserialization and reflective method dispatch in the Change Audit System listener reachable on TCP/16017 (IBM). · Vulnerabilities & Active Exploitation