CVE Program partner

synology

Synology Inc.

API
CVEs, 365 days61337 all time, 13 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationSynology Inc.
RoleCNA
TypeVendor
Reports tomitre
ScopeSynology issues only.
Advisorieshttps://www.synology.com/en-global/security/advisory

Latest CVEs · RSS

  • CVE-2026-40539 2026-09-18 · CVSS 7.1
    An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allow
  • CVE-2026-40538 2026-09-18 · CVSS 3.7
    An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280
  • CVE-2026-40535 2026-09-18 · CVSS 6.5
    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.
  • CVE-2026-40533 2026-09-18 · CVSS 5.3
    An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-
  • CVE-2026-40537 2026-09-18 · CVSS 4.3
    A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-
  • CVE-2026-40536 2026-09-18 · CVSS 4.3
    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-
  • CVE-2026-40534 2026-09-18 · CVSS 5.4
    An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before
  • CVE-2026-40532 2026-09-18 · CVSS 6.5
    A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-
  • CVE-2026-40531 2026-09-18 · CVSS 4.3
    An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 a
  • CVE-2026-4036 2026-09-18 · CVSS 6.5
    An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) befor
  • CVE-2026-40530 2026-09-18 · CVSS 8.0
    An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-728
  • CVE-2026-13683 2026-09-18 · CVSS 2.7
    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM
  • CVE-2026-13623 2026-09-18 · CVSS 4.8
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before
  • CVE-2026-13666 2026-09-18 · CVSS 3.5
    An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-
  • CVE-2026-6205 2026-09-18 · CVSS 8.1
    An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 a
  • CVE-2026-13673 2026-09-18 · CVSS 8.8
    An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7
  • CVE-2026-13635 2026-09-18 · CVSS 5.3
    An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 a
  • CVE-2026-13639 2026-09-18 · CVSS 9.8
    An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 all
  • CVE-2026-13684 2026-09-18 · CVSS 9.8
    An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7
  • CVE-2026-9548 2026-08-28 · CVSS 6.5
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-221
  • CVE-2026-9491 2026-08-28 · CVSS 4.3
    A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitiv
  • CVE-2026-40541 2026-08-28 · CVSS 9.0
    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-221
  • CVE-2026-4793 2026-08-03 · CVSS 7.3
    An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-o
  • CVE-2024-47263 2026-06-03 · CVSS 4.1
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup b
  • CVE-2024-47273 2026-06-03 · CVSS 4.3
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1

All CVE Program partners