Synology
Vulnerability activity for Synology: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 23
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 56
- Critical (CVSS 9+)
- 5
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighSep 18, 2026Synology DiskStation Manager (DSM) Crypto / certificateCVE-2026-40539An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
- 3.7LowSep 18, 2026Synology DiskStation Manager (DSM)CVE-2026-40538An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
- 6.5MediumSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-40535An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks.
- 5.3MediumSep 18, 2026Synology DiskStation Manager (DSM) Information disclosureCVE-2026-40533An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
- 4.3MediumSep 18, 2026Synology DiskStation Manager (DSM) SSRFCVE-2026-40537A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
- 4.3MediumSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-40536An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
- 5.4MediumSep 18, 2026Synology DiskStation Manager (DSM) XSSCVE-2026-40534An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched
- 6.5MediumSep 18, 2026Synology DiskStation Manager (DSM) Auth bypass / access controlCVE-2026-40532A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
- 4.3MediumSep 18, 2026Synology DiskStation Manager (DSM) Memory corruptionCVE-2026-40531An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
- 6.5MediumSep 18, 2026Synology DiskStation Manager (DSM) SQL injectionCVE-2026-4036An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.
- 8.0HighSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-40530An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the sy
- 2.7LowSep 18, 2026Synology DiskStation Manager (DSM) SQL injectionCVE-2026-13683An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtai
- 4.8MediumSep 18, 2026Synology DiskStation Manager (DSM) XSSCVE-2026-13623An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write
- 3.5LowSep 18, 2026Synology DiskStation Manager (DSM)CVE-2026-13666An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
- 8.1HighSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-6205An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
- 8.8HighSep 18, 2026Synology DiskStation Manager (DSM) Privilege escalationCVE-2026-13673An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
- 5.3MediumSep 18, 2026Synology DiskStation Manager (DSM) Information disclosureCVE-2026-13635An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- 9.8CriticalSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-13639An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- 9.8CriticalSep 18, 2026Synology DiskStation Manager (DSM) Path traversal / file handlingCVE-2026-13684An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- 6.5MediumAug 28, 2026Synology Chat Server XSSCVE-2026-9548An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks
- 4.3MediumAug 28, 2026Synology Chat Server SSRFCVE-2026-9491A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.
- 9.0CriticalAug 28, 2026Synology Chat Server XSSCVE-2026-40541An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
- 7.3HighAug 3, 2026Synology Assistant Privilege escalationCVE-2026-4793An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation.
- 6.2MediumMay 27, 2026Synology storage manager Information disclosureCVE-2026-2237A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.
- 6.1MediumMay 27, 2026Synology Assistant Auth bypass / access controlCVE-2025-66593An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
- 6.1MediumMay 27, 2026Synology Active Backup for Business Agent Auth bypass / access controlCVE-2025-66592An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
- 8.6HighMay 27, 2026Synology Active Backup for Business SQL injectionCVE-2025-30028A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
- 7.5HighMay 27, 2026Synology C2 Identity Edge ServerCVE-2025-14713An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.
- 6.1MediumMay 27, 2026Synology ActiveProtect Agent Auth bypass / access controlCVE-2025-13593Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
- 9.8CriticalMay 27, 2026Synology BeeStation OS Memory corruptionCVE-2025-12686Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.2.8% likely
- 8.1HighMay 27, 2026Synology DiskStation Manager (DSM)CVE-2025-13392Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
- 5.4MediumMay 27, 2026Synology Contacts XSSCVE-2025-13167Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.
- 5.9MediumMay 27, 2026Synology Safe Access XSSCVE-2025-10466Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct
- 2.7LowMay 27, 2026Synology Surveillance Station Auth bypass / access controlCVE-2024-47272Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
- 4.9MediumMay 27, 2026Synology Surveillance Station Information disclosureCVE-2024-47271Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
- 2.7LowMay 27, 2026Synology Surveillance StationCVE-2024-47270Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
- 4.9MediumMay 27, 2026Synology Surveillance Station Information disclosureCVE-2024-47269Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
- 4.9MediumMay 27, 2026Synology Surveillance Station Auth bypass / access controlCVE-2024-47268Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
- 2.7LowMay 27, 2026Synology Surveillance Station Path traversal / file handlingCVE-2024-47267Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vector
- 6.8MediumMay 27, 2026Synology BeeDrive for desktop Path traversal / file handlingCVE-2024-11399Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors.
- 7.8HighMay 27, 2026Synology BeeDrive for desktop Privilege escalationCVE-2023-52945Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors.
- 8.1HighApr 10, 2026Synology SSL VPN ClientCVE-2021-47961A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined
- 6.5MediumApr 10, 2026Synology SSL VPN Client Path traversal / file handlingCVE-2021-47960A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page,
- 6.7MediumFeb 24, 2026Synology Presto Client Privilege escalationCVE-2026-3091An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer.
- 5.6MediumDec 4, 2025Synology BeeDrive for desktop Auth bypass / access controlCVE-2025-8074Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.
- 7.8HighDec 4, 2025Synology BeeDrive for desktop Path traversal / file handlingCVE-2025-54160Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
- 7.5HighDec 4, 2025Synology BeeDrive for desktop Auth bypass / access controlCVE-2025-54159Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
- 7.8HighDec 4, 2025Synology BeeDrive for desktop Auth bypass / access controlCVE-2025-54158Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
- 6.3MediumDec 4, 2025Synology Mail Server Auth bypass / access controlCVE-2025-2848A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
- 7.2HighDec 4, 2025Synology Router Manager (SRM) Path traversal / file handlingCVE-2025-29846A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
Top products
- DiskStation Manager (DSM)23 CVEs in the last year, 3 critical
- Surveillance Station6 CVEs in the last year
- BeeDrive for desktop6 CVEs in the last year
- Synology Router Manager (SRM)4 CVEs in the last year
- Synology Chat Server3 CVEs in the last year, 1 critical
- Synology SSL VPN Client2 CVEs in the last year
- Synology Assistant2 CVEs in the last year
- Synology Presto Client1 CVE in the last year
- Synology Mail Server1 CVE in the last year
- Synology Contacts1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Synology · Sep 18, 2026Synology-SA-26:13 DSMCVE-2026-13623CVE-2026-13635CVE-2026-13639CVE-2026-13666CVE-2026-13673CVE-2026-13683
- Synology · Aug 3, 2026Synology-SA-26:12 Synology AssistantCVE-2026-4793
- Synology · Jun 26, 2026Synology-SA-26:11 Synology MailPlus ServerCVE-2025-15660CVE-2026-13135CVE-2026-13136
- Synology · May 26, 2026Synology-SA-26:10 Synology Chat ServerCVE-2026-40541CVE-2026-9491CVE-2026-9548
- Synology · Apr 15, 2026Synology-SA-26:07 DSMCVE-2026-40540
- Synology · Apr 15, 2026Synology-SA-26:06 DSMCVE-2026-4036CVE-2026-40530CVE-2026-40531CVE-2026-40532CVE-2026-40533CVE-2026-40534
- Synology · Apr 10, 2026Synology-SA-26:05 Synology SSL VPN ClientCVE-2021-47960CVE-2021-47961
- Synology · Mar 31, 2026Synology-SA-26:04 Mail StationCVE-2026-5129
- Synology · Feb 24, 2026Synology-SA-26:02 Synology Presto ClientCVE-2026-3091
- Synology · Feb 9, 2026Synology-SA-26:01 Storage ManagerCVE-2026-2237
- Synology · Dec 16, 2025Synology-SA-25:18 C2 Identity Edge Server (PWN2OWN 2025)CVE-2025-14713
- Synology · Dec 8, 2025Synology-SA-25:17 Synology AssistantCVE-2025-66593
- Synology · Dec 8, 2025Synology-SA-25:16 Synology Active Backup for Business AgentCVE-2025-66592
- Synology · Nov 25, 2025Synology-SA-25:15 ActiveProtect AgentCVE-2025-13593
- Synology · Nov 19, 2025Synology-SA-25:14 DSM (PWN2OWN 2025)CVE-2025-13392
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.