https://vulnogram.org/ Most recent CVEs assigned by Synology Inc. (synology). https://vulnogram.org/seaview/icons/synology.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-40539 https://vulnogram.org/CVE-2026-40539 An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-servi… High Fri, 18 Sep 2026 08:29:33 GMT https://vulnogram.org/CVE-2026-40538 https://vulnogram.org/CVE-2026-40538 An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attack… Low Network Exploitable Fri, 18 Sep 2026 08:29:15 GMT https://vulnogram.org/CVE-2026-40535 https://vulnogram.org/CVE-2026-40535 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files… Medium Network Exploitable Fri, 18 Sep 2026 08:28:55 GMT https://vulnogram.org/CVE-2026-40533 https://vulnogram.org/CVE-2026-40533 An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information. Medium Network Exploitable Fri, 18 Sep 2026 08:28:35 GMT https://vulnogram.org/CVE-2026-40537 https://vulnogram.org/CVE-2026-40537 A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information. Medium Fri, 18 Sep 2026 08:28:13 GMT https://vulnogram.org/CVE-2026-40536 https://vulnogram.org/CVE-2026-40536 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-… Medium Fri, 18 Sep 2026 08:27:53 GMT https://vulnogram.org/CVE-2026-40534 https://vulnogram.org/CVE-2026-40534 An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read… Medium Fri, 18 Sep 2026 08:27:28 GMT https://vulnogram.org/CVE-2026-40532 https://vulnogram.org/CVE-2026-40532 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information. Medium Fri, 18 Sep 2026 08:27:07 GMT https://vulnogram.org/CVE-2026-40531 https://vulnogram.org/CVE-2026-40531 An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks. Medium Fri, 18 Sep 2026 08:26:45 GMT https://vulnogram.org/CVE-2026-4036 https://vulnogram.org/CVE-2026-4036 An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obt… Medium Fri, 18 Sep 2026 08:26:18 GMT https://vulnogram.org/CVE-2026-40530 https://vulnogram.org/CVE-2026-40530 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files… High Fri, 18 Sep 2026 08:25:51 GMT https://vulnogram.org/CVE-2026-13683 https://vulnogram.org/CVE-2026-13683 An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenti… Low Fri, 18 Sep 2026 08:22:58 GMT https://vulnogram.org/CVE-2026-13623 https://vulnogram.org/CVE-2026-13623 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated use… Medium Fri, 18 Sep 2026 08:22:41 GMT https://vulnogram.org/CVE-2026-13666 https://vulnogram.org/CVE-2026-13666 An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited fi… Low Fri, 18 Sep 2026 08:22:29 GMT https://vulnogram.org/CVE-2026-6205 https://vulnogram.org/CVE-2026-6205 An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial… High Fri, 18 Sep 2026 08:22:15 GMT https://vulnogram.org/CVE-2026-13673 https://vulnogram.org/CVE-2026-13673 An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary fi… High Fri, 18 Sep 2026 08:22:00 GMT https://vulnogram.org/CVE-2026-13635 https://vulnogram.org/CVE-2026-13635 An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information. Medium Network Exploitable Fri, 18 Sep 2026 08:21:42 GMT https://vulnogram.org/CVE-2026-13639 https://vulnogram.org/CVE-2026-13639 An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attack… Critical Network Exploitable Fri, 18 Sep 2026 08:21:27 GMT https://vulnogram.org/CVE-2026-13684 https://vulnogram.org/CVE-2026-13684 An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-se… Critical Network Exploitable Fri, 18 Sep 2026 08:19:14 GMT https://vulnogram.org/CVE-2026-9548 https://vulnogram.org/CVE-2026-9548 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted fi… Medium Fri, 28 Aug 2026 07:08:51 GMT https://vulnogram.org/CVE-2026-9491 https://vulnogram.org/CVE-2026-9491 A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information. Medium Fri, 28 Aug 2026 07:07:57 GMT https://vulnogram.org/CVE-2026-40541 https://vulnogram.org/CVE-2026-40541 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary fil… Critical Fri, 28 Aug 2026 07:07:24 GMT https://vulnogram.org/CVE-2026-4793 https://vulnogram.org/CVE-2026-4793 An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation. High Mon, 03 Aug 2026 06:00:39 GMT https://vulnogram.org/CVE-2024-47263 https://vulnogram.org/CVE-2024-47263 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write… Medium Wed, 03 Jun 2026 13:35:35 GMT https://vulnogram.org/CVE-2024-47273 https://vulnogram.org/CVE-2024-47273 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors. Medium Wed, 03 Jun 2026 13:31:24 GMT https://vulnogram.org/CVE-2022-49036 https://vulnogram.org/CVE-2022-49036 An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors. High Wed, 03 Jun 2026 13:26:18 GMT https://vulnogram.org/CVE-2022-49042 https://vulnogram.org/CVE-2022-49042 An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors. High Wed, 03 Jun 2026 13:23:29 GMT https://vulnogram.org/CVE-2023-52951 https://vulnogram.org/CVE-2023-52951 A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. Medium Network Exploitable Wed, 03 Jun 2026 13:11:43 GMT https://vulnogram.org/CVE-2026-2237 https://vulnogram.org/CVE-2026-2237 A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. Medium Wed, 27 May 2026 08:44:29 GMT https://vulnogram.org/CVE-2025-66593 https://vulnogram.org/CVE-2025-66593 An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. Medium Wed, 27 May 2026 08:43:51 GMT https://vulnogram.org/CVE-2025-66592 https://vulnogram.org/CVE-2025-66592 An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. Medium Wed, 27 May 2026 08:43:05 GMT https://vulnogram.org/CVE-2025-30028 https://vulnogram.org/CVE-2025-30028 A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. High Network Exploitable Wed, 27 May 2026 08:40:46 GMT https://vulnogram.org/CVE-2025-14713 https://vulnogram.org/CVE-2025-14713 An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. High Network Exploitable Wed, 27 May 2026 08:39:35 GMT https://vulnogram.org/CVE-2025-13593 https://vulnogram.org/CVE-2025-13593 Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. Medium Wed, 27 May 2026 08:38:27 GMT https://vulnogram.org/CVE-2025-12686 https://vulnogram.org/CVE-2025-12686 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. Critical Network Exploitable Wed, 27 May 2026 08:37:03 GMT https://vulnogram.org/CVE-2025-13392 https://vulnogram.org/CVE-2025-13392 Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge… High Network Exploitable Wed, 27 May 2026 08:36:06 GMT https://vulnogram.org/CVE-2025-13167 https://vulnogram.org/CVE-2025-13167 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sens… Medium Wed, 27 May 2026 08:34:19 GMT https://vulnogram.org/CVE-2025-10466 https://vulnogram.org/CVE-2025-10466 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific file… Medium Wed, 27 May 2026 08:32:02 GMT https://vulnogram.org/CVE-2024-47272 https://vulnogram.org/CVE-2024-47272 Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. Low Wed, 27 May 2026 08:30:22 GMT https://vulnogram.org/CVE-2024-47271 https://vulnogram.org/CVE-2024-47271 Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecifi… Medium Wed, 27 May 2026 08:30:12 GMT https://vulnogram.org/CVE-2024-47270 https://vulnogram.org/CVE-2024-47270 Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecifie… Low Wed, 27 May 2026 08:29:56 GMT https://vulnogram.org/CVE-2024-47269 https://vulnogram.org/CVE-2024-47269 Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive informati… Medium Wed, 27 May 2026 08:29:47 GMT https://vulnogram.org/CVE-2024-47268 https://vulnogram.org/CVE-2024-47268 Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors. Medium Wed, 27 May 2026 08:29:31 GMT https://vulnogram.org/CVE-2024-47267 https://vulnogram.org/CVE-2024-47267 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privi… Low Wed, 27 May 2026 08:29:16 GMT https://vulnogram.org/CVE-2024-11399 https://vulnogram.org/CVE-2024-11399 Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors. Medium Wed, 27 May 2026 08:26:49 GMT https://vulnogram.org/CVE-2023-52945 https://vulnogram.org/CVE-2023-52945 Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. High Wed, 27 May 2026 08:25:46 GMT https://vulnogram.org/CVE-2021-47961 https://vulnogram.org/CVE-2021-47961 A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential int… High Network Exploitable Fri, 10 Apr 2026 09:22:37 GMT https://vulnogram.org/CVE-2021-47960 https://vulnogram.org/CVE-2021-47960 A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By lev… Medium Network Exploitable Fri, 10 Apr 2026 09:21:54 GMT https://vulnogram.org/CVE-2026-3091 https://vulnogram.org/CVE-2026-3091 An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same dire… Medium Tue, 24 Feb 2026 02:31:20 GMT https://vulnogram.org/CVE-2025-8074 https://vulnogram.org/CVE-2025-8074 Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors. Medium Thu, 04 Dec 2025 15:17:42 GMT