Synology DiskStation Manager

19 known vulnerabilities in Synology DiskStation Manager, 2 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-6205 CVSS 8.1 high An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12…
  • CVE-2026-4036 CVSS 6.5 medium An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology…
  • CVE-2026-40539 CVSS 7.1 high An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7…
  • CVE-2026-40538 CVSS 3.7 low An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before…
  • CVE-2026-40537 CVSS 4.3 medium A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10…
  • CVE-2026-40536 CVSS 4.3 medium An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation…
  • CVE-2026-40535 CVSS 6.5 medium An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation…
  • CVE-2026-40534 CVSS 5.4 medium An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation…
  • CVE-2026-40533 CVSS 5.3 medium An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before…
  • CVE-2026-40532 CVSS 6.5 medium A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10…
  • CVE-2026-40531 CVSS 4.3 medium An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10…
  • CVE-2026-40530 CVSS 8.0 high An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before…
  • CVE-2026-13684 CVSS 9.8 critical An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12…
  • CVE-2026-13683 CVSS 2.7 low An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology…
  • CVE-2026-13673 CVSS 8.8 high An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before…
  • CVE-2026-13666 CVSS 3.5 low An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before…
  • CVE-2026-13639 CVSS 9.8 critical An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9…
  • CVE-2026-13635 CVSS 5.3 medium An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12…
  • CVE-2026-13623 CVSS 4.8 medium An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation…