DiskStation Manager (DSM) at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 27 | 1 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 19 | 2 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 3 | 1 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 4 | 1 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Latest advisories
-
High max 7.5NCSC-2025-0091 1 CVE
Kwetsbaarheid verholpen in Synology DiskStation Manager
Synology heeft een kwetsbaarheid verholpen in Synology DiskStation Manager (DSM).
99 results · Feed
-
Critical 9.8CVE-2026-76954 Public exploit
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskSta…
-
High 8.6
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager …
-
Medium 4.3
An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (…
-
Medium 4.3
A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009…
-
Medium 4.3
A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 an…
-
Medium 4.3
A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86…
-
Medium 4.3
An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStat…
-
Medium 4.3
A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 a…
-
Medium 5.3
A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.…
-
Medium 5.3
An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-860…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskSt…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation M…
-
Medium 5.4
A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4…
-
Medium 5.4
An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStatio…
-
Medium 5.9
An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2…
-
Medium 6.5
An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager…
-
Medium 6.5
An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before…
-
Medium 6.5
A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DS…
-
Medium 6.8
An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before…
-
High 7.2
An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStati…
-
High 7.5
An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
-
High 8.1
An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskSta…
-
High 8.1
An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before …
-
High 8.1
An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (D…
-
High 8.8
A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.…
-
High 8.8
An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation…
-
High 8.8
An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) …
-
High 7.1
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-…
-
Low 3.7
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manage…
-
Medium 6.5
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synol…
-
Medium 5.3
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager …
-
Medium 4.3
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 4.3
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synolog…
-
Medium 5.4
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in S…
-
Medium 6.5
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1…
-
Medium 4.3
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69…
-
Medium 6.5
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in…
-
High 8.0
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manag…
-
Low 2.7
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler…
-
Medium 4.8
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in S…