Synology DSM vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
31 matching records
- Medium4.3An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036…Check if you run itEPSS 0.28%Jun 3, 2026
- Medium4.1An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4…Check if you run itEPSS 0.30%Jun 3, 2026
- Medium5.9A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.Check if you run itEPSS 0.13%Jun 3, 2026
- High7.8An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users…Check if you run itEPSS 0.12%Jun 3, 2026
- High7.8An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before…Check if you run itEPSS 0.12%Jun 3, 2026
- Medium4.1OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors.Check if you run itEPSS 0.10%May 11, 2026
- High8.1A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to…Check if you run itEPSS 0.32%Apr 10, 2026
- Medium6.5A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the ins…Check if you run itEPSS 0.19%Apr 10, 2026
- Medium6.3OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account config…Check if you run itEPSS 0.24%Apr 9, 2026
- High8.3OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty…Check if you run itEPSS 0.33%Mar 19, 2026
- High7.3An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of…Check if you run itEPSS 0.16%Feb 24, 2026
- High7.5Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.Check if you run itEPSS 0.41%Dec 4, 2025
- High7.8Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecifCheck if you run itEPSS 0.18%Dec 4, 2025
- Medium6.3A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.Check if you run itEPSS 0.37%Dec 4, 2025
- High7.2A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.Check if you run itEPSS 0.64%Dec 4, 2025
- Medium4.3A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.Check if you run itEPSS 0.43%Dec 4, 2025
- Medium4.3A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.Check if you run itEPSS 0.43%Dec 4, 2025
- Medium5.4A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.Check if you run itEPSS 0.37%Dec 4, 2025
- Medium4.3Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-7280Check if you run itEPSS 0.38%Dec 4, 2025
- High7.5Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-Check if you run itEPSS 0.48%Dec 4, 2025
- Critical9.6Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUCheck if you run itEPSS 0.37%Dec 4, 2025
- Medium5.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator prCheck if you run itEPSS 0.27%Aug 29, 2025
- Medium5.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11Check if you run itEPSS 0.24%Jul 23, 2025
- Medium5.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-1Check if you run itEPSS 0.24%Jul 23, 2025
- High7.2Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-Check if you run itEPSS 1.20%Jul 23, 2025