public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical2canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-09-25 08:54 UTC / 2026-09-25 17:54 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-09-25

defensive priority signal

CRITICALEPSS 0.0066 (50)NEW-NVD: An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2… Handoff

2026-09-25

defensive priority signal

CRITICALEPSS 0.0060 (46)NEW-NVD: An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0039 (31)NEW-NVD: An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0049 (40)NEW-NVD: An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0012 (1)NEW-NVD: An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0050 (40)NEW-NVD: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0042 (34)NEW-NVD: A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0021 (10)NEW-NVD: HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. NVD: Improper handling of fi… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0027 (17)NEW-NVD: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskSta… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0038 (29)NEW-NVD: An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0034 (25)NEW-NVD: An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0016 (5)NEW-NVD: HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0025 (14)NEW-NVD: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskSta… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0019 (8)NEW-NVD: The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0044 (35)NEW-NVD: An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0042 (34)NEW-NVD: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation M… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0033 (23)NEW-NVD: A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2… Handoff

2026-09-25

defensive priority signal

LOWEPSS 0.0037 (28)NEW-NVD: An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before… Handoff

2026-09-25

defensive priority signal

LOWEPSS 0.0025 (14)NEW-NVD: An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) bef… Handoff

2026-09-25

defensive priority signal

LOWEPSS 0.0032 (23)NEW-NVD: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synolog… Handoff

Public-safe defensive signals

CVE-2026-13639 CRITICAL CVSS 9.8 -
NVD: An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure; CVSS 9.8 (CRITICAL); EPSS percentile 50; sources: NVD.
CVE-2026-13684 CRITICAL CVSS 9.8 -
NVD: An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service...
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure; CVSS 9.8 (CRITICAL); EPSS percentile 46; sources: NVD.
CVE-2026-13673 HIGH CVSS 8.8 -
NVD: An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 8.8 (HIGH); EPSS percentile 31; sources: NVD.
CVE-2026-40530 HIGH CVSS 8.0 -
NVD: An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 8.0 (HIGH); EPSS percentile 40; sources: NVD.
CVE-2026-40539 HIGH CVSS 7.1 -
NVD: An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.1 (HIGH); EPSS percentile 1; sources: NVD.
CVE-2026-40535 MEDIUM CVSS 6.5 -
NVD: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and...
A remote attacker may be able to reach files outside the intended application path; CVSS 6.5 (MEDIUM); EPSS percentile 40; sources: NVD.
CVE-2026-40532 MEDIUM CVSS 6.5 -
NVD: A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
An attacker may be able to access information that should not be exposed; CVSS 6.5 (MEDIUM); EPSS percentile 34; sources: NVD.
CVE-2026-21822 MEDIUM CVSS 6.3 -
NVD: HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. NVD: Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.
An attacker may be able to reach files outside the intended application path; CVSS 6.3 (MEDIUM); EPSS percentile 10; sources: NVD.
CVE-2026-40534 MEDIUM CVSS 5.4 -
NVD: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · authenticated boundary; CVSS 5.4 (MEDIUM); EPSS percentile 17; sources: NVD.
CVE-2026-40533 MEDIUM CVSS 5.3 -
NVD: An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
A remote attacker may be able to access information that should not be exposed; CVSS 5.3 (MEDIUM); EPSS percentile 29; sources: NVD.
CVE-2026-13635 MEDIUM CVSS 5.3 -
NVD: An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
A remote attacker may be able to access information that should not be exposed; CVSS 5.3 (MEDIUM); EPSS percentile 25; sources: NVD.
CVE-2026-21848 MEDIUM CVSS 5.0 -
NVD: HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 5.0 (MEDIUM); EPSS percentile 5; sources: NVD.
CVE-2026-13623 MEDIUM CVSS 4.8 -
NVD: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · authenticated boundary; CVSS 4.8 (MEDIUM); EPSS percentile 14; sources: NVD.
CVE-2025-13533 MEDIUM CVSS 4.4 -
NVD: The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. NVD: This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. NVD: This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · authenticated boundary; CVSS 4.4 (MEDIUM); EPSS percentile 8; sources: NVD.
CVE-2026-40531 MEDIUM CVSS 4.3 -
NVD: An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 4.3 (MEDIUM); EPSS percentile 35; sources: NVD.
CVE-2026-40536 MEDIUM CVSS 4.3 -
NVD: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive...
An attacker may be able to reach files outside the intended application path; CVSS 4.3 (MEDIUM); EPSS percentile 34; sources: NVD.
CVE-2026-40537 MEDIUM CVSS 4.3 -
NVD: A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
An attacker may be able to access information that should not be exposed; CVSS 4.3 (MEDIUM); EPSS percentile 23; sources: NVD.
CVE-2026-40538 LOW CVSS 3.7 -
NVD: An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure; CVSS 3.7 (LOW); EPSS percentile 28; sources: NVD.
CVE-2026-13666 LOW CVSS 3.5 -
NVD: An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when...
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 3.5 (LOW); EPSS percentile 14; sources: NVD.
CVE-2026-13683 LOW CVSS 2.7 -
NVD: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated...
An attacker may be able to read or change database-backed application data; CVSS 2.7 (LOW); EPSS percentile 23; sources: NVD.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-09-25 08:54 UTC / 2026-09-25 17:54 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2025-13533: newly added to the public-safe set.
CVE-2026-13623: newly added to the public-safe set.
CVE-2026-13635: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-09-24 23:55 UTC / 2026-09-25 08:55 JST

Items compared20 -> 20

Feed generated2026-09-25 08:54 UTC / 2026-09-25 17:54 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV0

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-09-2520

Severity Distribution

CRITICAL 2
HIGH 3
MEDIUM 12
LOW 3
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-13639

Critical / High2 / 3

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 2,
    "HIGH": 3,
    "LOW": 3,
    "MEDIUM": 12,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-13639"
}

Source Status

NVD20 signalsLast observed: 2026-09-25Status: healthy

EPSS20 signalsLast observed: 2026-09-25Status: healthy

OSV0 signalsLast observed: 2026-09-25Status: not observed

Vendor Advisory20 signalsLast observed: 2026-09-25Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled