Vendor
Synology
344 known vulnerabilities.
Synology at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 27 | 1 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 19 | 2 |
| Aug 2026 | 4 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 5 | 0 |
| May 2026 | 18 | 1 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 1 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 12 | 1 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 3 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 8 | 3 |
| Feb 2025 | 3 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 11 | 0 |
Products
DiskStation Manager (DSM) 99
Synology Router Manager (SRM) 43
Surveillance Station 25
Synology Photo Station 18
Synology DiskStation Manager (DSM) 13
Photo Station 12
Camera Firmware 9
Calendar 6
Unified Controller (DSMUC) 6
BeeDrive for desktop 6
Synology Drive Client 6
Media Server 5
Synology Calendar 5
Synology Active Backup for Business Agent 5
Note Station 4
Drive 4
Active Backup for Business 4
Synology SSL VPN Client 3
Download Station 3
Audio Station 3
Synology Chat Server 3
BeeStation OS (BSM) 3
Safe Access 3
Synology Download Station 3
Synology Video Station 2
Office 2
Application Service 2
Presto File Server 2
Synology Drive Server 2
File Station 2
SSL VPN Client 2
Chat 2
CardDAV Server 2
Hyper Backup 2
Synology Note Station Client 2
MailPlus Server 2
SSO Server 2
Synology Assistant 2
Synology Docker 1
VPN Plus Server 1
Latest advisories
-
Critical max 9.2
Node.js: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
first Oct 21, 2026 -
HighWID-SEC-2026-4430 0 CVEs
Synology DiskStation Manager: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site…
-
High max 8.0
Synology DiskStation Manager: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
first Apr 14, 2026 -
High max 9.8WID-SEC-2026-3463 8 CVEs
Synology DiskStation Manager: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um einen …
-
High max 4.3
Samba: Mehrere Schwachstellen
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Samba ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, einen Denial of Service Zustand zu verursachen oder seine Rechte zu erweitern.
first Jul 26, 2022
344 results · Feed
-
Critical 9.8
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskSta…
-
High 8.6
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager …
-
Medium 4.3
An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (…
-
Medium 4.3
A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009…
-
Medium 4.3
A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 an…
-
Medium 4.3
A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86…
-
Medium 4.3
An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStat…
-
Medium 4.3
A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 a…
-
Medium 5.3
A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.…
-
Medium 5.3
An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-860…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskSt…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation M…
-
Medium 5.4
A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStatio…
-
Medium 5.9
An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2…
-
Medium 6.5
An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager…
-
Medium 6.5
An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before…
-
Medium 6.5
A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DS…
-
Medium 6.8
An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before…
-
High 7.2
An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStati…
-
High 7.5
An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
-
High 8.1
An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskSta…
-
High 8.1
An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before …
-
High 8.1
An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (D…
-
High 8.8
A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.…
-
High 8.8
An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation…
-
High 8.8
An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) …
-
High 7.1
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-…
-
Low 3.7
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manage…
-
Medium 6.5
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synol…
-
Medium 5.3
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager …
-
Medium 4.3
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 4.3
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synolog…
-
Medium 5.4
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in S…
-
Medium 6.5
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 4.3
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69…
-
Medium 6.5
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in…
-
High 8.0
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manag…
-
Low 2.7
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler…
-
Medium 4.8
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in S…