Synology DSM security vulnerabilities
Networking / NAS. Public CVE monitoring for Synology DSM. Vendor security advisories are linked on this page.
Built for Operators of this product.
31 public records · 0 security-fix timeline events. 0 published in the last 7 days. 17 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-060 issues2026-11-03
Known exploited
View all known exploitedRecently published
Browse catalog- Medium5.9A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.Check if you run itEPSS 0.13%Jun 3, 2026
- Medium4.1OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors.Check if you run itEPSS 0.10%May 11, 2026
- High7.5Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.Check if you run itEPSS 0.41%Dec 4, 2025
- High7.8Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecifCheck if you run itEPSS 0.18%Dec 4, 2025
- Medium6.3A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.Check if you run itEPSS 0.37%Dec 4, 2025
- High7.2A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.Check if you run itEPSS 0.64%Dec 4, 2025
- Medium4.3A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.Check if you run itEPSS 0.43%Dec 4, 2025
- Medium4.3A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.Check if you run itEPSS 0.43%Dec 4, 2025
- Medium5.4A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.Check if you run itEPSS 0.37%Dec 4, 2025
- Medium4.3Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-7280Check if you run itEPSS 0.38%Dec 4, 2025