Synology’s DDoS advisory for DSM flags CVE-2026-76954, a 9.8 SQL injection in DSM Auth API affecting 7.4 through 7.2.1 users.