Synology vulnerabilities

Products

• Diskstation Manager 97
• Diskstation Manager (dsm) 72
• Router Manager 59
• Router Manager (srm) 43
• Photo Station 34
• Surveillance Station 28
• Surveillance Station 25
• Vs960hd Firmware 22
• Diskstation Manager Unified Controller 20
• Photo Station 18
• Skynas 16
• Camera Firmware 13
• Skynas Firmware 13
• Diskstation Manager (dsm) 13
• Photo Station 12
• Calendar 11
• Bc500 Firmware 9
• Tc500 Firmware 9
• Unified Controller (dsmuc) 9
• Active Backup For Business Agent 8
• Download Station 8
• Drive 7
• Beedrive 6
• Beedrive For Desktop 6
• Camera Firmware 6
• Drive Client 6
• Drive Server 6
• Media Server 6
• Drive Client 6
• Video Station 6
• Dns Server 5
• Media Server 5
• Note Station 5
• Ssl Vpn Client 5
• Active Backup For Business Agent 5
• Calendar 5
• Active Backup For Business 4
• Application Service 4
• Audio Station 4
• Beestation Os 4

Show 37 moreShow less

• Directory Server 4
• Note Station 4
• Radius Server 4
• Assistant 3
• Audio Station 3
• Beestation Manager (bsm) 3
• Beestation Os (bsm) 3
• Carddav Server 3
• Chat 3
• Download Station 3
• File Station 3
• Mailplus Server 3
• Office 3
• Safe Access 3
• Chat Server 3
• Download Station 3
• Ssl Vpn Client 3
• Virtual Diskstation Manager 3
• Application Service 2
• Carddav Server 2
• Dns Server 2
• Dsm 2
• File Station 2
• Hyper Backup 2
• Hyper Backup 2
• Mailplus Server 2
• Moments 2
• Presto File Server 2
• Presto File Server 2
• Safeaccess 2
• Ssl Vpn Client 2
• Sso Server 2
• Sso Server 2
• Assistant 2
• Drive Server 2
• Note Station Client 2
• Video Station 2

Newest

• synology diskstation manager (dsm) An improper certificate validation vulnerability in Email API in Synology DiskStation Manager ... CVE-2026-40539 7.1 HighSeptember 18, 2026
• synology diskstation manager (dsm) An improper restriction of excessive authentication attempts vulnerability in Auto block in... CVE-2026-40538 3.7 LowSeptember 18, 2026
• synology diskstation manager (dsm) An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability... CVE-2026-40535 6.5 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An exposure of sensitive information through data queries vulnerability in Desktop API in... CVE-2026-40533 5.3 MediumSeptember 18, 2026
• synology diskstation manager (dsm) A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation... CVE-2026-40537 4.3 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability... CVE-2026-40536 4.3 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of input during web page generation ('cross-site scripting')... CVE-2026-40534 5.4 MediumSeptember 18, 2026
• synology diskstation manager (dsm) A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation... CVE-2026-40532 6.5 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager... CVE-2026-40531 4.3 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of special elements used in an SQL command ('SQL injection')... CVE-2026-4036 6.5 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in... CVE-2026-40530 8.0 HighSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of special elements used in an SQL command ('SQL Injection')... CVE-2026-13683 2.7 LowSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of input during web page generation ('Cross-site Scripting')... CVE-2026-13623 4.8 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in... CVE-2026-13666 3.5 LowSeptember 18, 2026
• synology diskstation manager (dsm) An external control of file name or path vulnerability in Upload API in Synology DiskStation... CVE-2026-6205 8.1 HighSeptember 18, 2026
• synology diskstation manager (dsm) An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology... CVE-2026-13673 8.8 HighSeptember 18, 2026
• synology diskstation manager (dsm) An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation... CVE-2026-13635 5.3 MediumSeptember 18, 2026
• synology diskstation manager (dsm) An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before... CVE-2026-13639 9.8 CriticalSeptember 18, 2026
• synology diskstation manager (dsm) An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager ... CVE-2026-13684 Public exploit 9.8 CriticalSeptember 18, 2026
• synology chat server An improper neutralization of input during web page generation ('Cross-site Scripting')... CVE-2026-9548 6.5 MediumAugust 28, 2026
• synology chat server A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5... CVE-2026-9491 4.3 MediumAugust 28, 2026
• synology chat server An improper neutralization of input during web page generation ('Cross-site Scripting')... CVE-2026-40541 9.0 CriticalAugust 28, 2026
• synology assistant An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows... CVE-2026-4793 7.3 HighAugust 3, 2026
• bosch camera firmware A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an... CVE-2024-58330 7.5 HighJuly 23, 2026
• synology hyper backup An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability... CVE-2024-47263 4.1 MediumJune 3, 2026
• synology hyper backup An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability... CVE-2024-47273 4.3 MediumJune 3, 2026
• synology active backup for business recovery media creator An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL... CVE-2022-49036 7.8 HighJune 3, 2026
• synology hyper backup explorer An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component... CVE-2022-49042 7.8 HighJune 3, 2026
• synology note station client A cleartext transmission of sensitive information vulnerability in Synology Note Station Client... CVE-2023-52951 5.9 MediumJune 3, 2026
• dell storage manager A use of get request method with sensitive query strings vulnerability in volume encryption of... CVE-2026-2237 6.2 MediumMay 27, 2026
• synology assistant An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local... CVE-2025-66593 6.1 MediumMay 27, 2026
• synology active backup for business agent An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1... CVE-2025-66592 6.1 MediumMay 27, 2026
• synology active backup for business A vulnerability in Active Backup for Business allows unauthorized remote attackers to read... CVE-2025-30028 8.6 HighMay 27, 2026
• synology c2 identity edge server An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package... CVE-2025-14713 7.5 HighMay 27, 2026
• synology activeprotect agent Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows... CVE-2025-13593 6.1 MediumMay 27, 2026
• synology beestation os Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in... CVE-2025-12686 9.8 CriticalMay 27, 2026
• synology diskstation manager (dsm), diskstation manager +1 more Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation... CVE-2025-13392 8.1 HighMay 27, 2026
• synology contacts Improper neutralization of input during web page generation ('Cross-site Scripting')... CVE-2025-13167 5.4 MediumMay 27, 2026
• synology safe access Improper neutralization of input during web page generation ('Cross-site Scripting')... CVE-2025-10466 5.9 MediumMay 27, 2026
• synology surveillance station Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station... CVE-2024-47272 2.7 LowMay 27, 2026
• synology surveillance station Insufficiently protected credentials vulnerability in IPSpeaker component in Synology... CVE-2024-47271 4.9 MediumMay 27, 2026
• synology surveillance station Improper preservation of permissions vulnerability in Archiving Push functionality in Synology... CVE-2024-47270 2.7 LowMay 27, 2026
• synology surveillance station Cleartext transmission of sensitive information vulnerability in Export Key functionality in... CVE-2024-47269 4.9 MediumMay 27, 2026
• synology surveillance station Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station... CVE-2024-47268 4.9 MediumMay 27, 2026
• synology surveillance station Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in... CVE-2024-47267 2.7 LowMay 27, 2026
• synology beedrive, beedrive for desktop +1 more Files or directories accessible to external parties vulnerability in redis-server component in... CVE-2024-11399 6.8 MediumMay 27, 2026
• synology beedrive, beedrive for desktop +1 more Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for... CVE-2023-52945 7.8 HighMay 27, 2026
• synology dns server Technitium DNS Server excessive DNSSEC requests CVE-2026-45557 6.9 MediumMay 19, 2026
• synology ssl vpn client A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684... CVE-2021-47961 8.1 HighApril 10, 2026
• synology ssl vpn client A files or directories accessible to external parties vulnerability in Synology SSL VPN Client... CVE-2021-47960 6.5 MediumApril 10, 2026
• Show olderLoading…