Advisories · Technology

Synology DiskStation Manager (DSM).

Every CVE that names Synology DiskStation Manager (DSM) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-40539 CVE record

CVSS 7.1 High

Improper certificate validation in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Weak cryptography or TLS
Not analysed yet 18 Sept 2026
CVE-2026-40538 CVE record

CVSS 3.7 Low

Unlimited authentication attempts in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Authentication bypass
Not analysed yet 18 Sept 2026
CVE-2026-40535 CVE record

CVSS 6.5 Medium

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 18 Sept 2026
CVE-2026-40533 CVE record

CVSS 5.3 Medium

Synology DiskStation Manager (DSM): An exposure of sensitive information through data queries vulnerability in Desktop API in…
- Synology DiskStation Manager (DSM)
- CWE-202
Not analysed yet 18 Sept 2026
CVE-2026-40537 CVE record

CVSS 4.3 Medium

Server-side request forgery in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-40536 CVE record

CVSS 4.3 Medium

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 18 Sept 2026
CVE-2026-40534 CVE record

CVSS 5.4 Medium

Cross-site scripting in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Cross-site scripting (XSS)
Not analysed yet 18 Sept 2026
CVE-2026-40532 CVE record

CVSS 6.5 Medium

Forced browsing in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-40531 CVE record

CVSS 4.3 Medium

Integer overflow in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 18 Sept 2026
CVE-2026-4036 CVE record

CVSS 6.5 Medium

SQL injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- SQL injection
Not analysed yet 18 Sept 2026
CVE-2026-40530 CVE record

CVSS 8.0 High

CRLF injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Other injection
Not analysed yet 18 Sept 2026
CVE-2026-13683 CVE record

CVSS 2.7 Low

SQL injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- SQL injection
Not analysed yet 18 Sept 2026
CVE-2026-13623 CVE record

CVSS 4.8 Medium

Cross-site scripting in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Cross-site scripting (XSS)
Not analysed yet 18 Sept 2026
CVE-2026-13666 CVE record

CVSS 3.5 Low

CRLF injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Other injection
Not analysed yet 18 Sept 2026
CVE-2026-6205 CVE record

CVSS 8.1 High

External control of a file path in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 18 Sept 2026
CVE-2026-13673 CVE record

CVSS 8.8 High

Incorrect permission assignment in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-13635 CVE record

CVSS 5.3 Medium

Improper output encoding in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- CWE-116
Not analysed yet 18 Sept 2026
CVE-2026-13639 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Synology DiskStation Manager (DSM): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…
- Synology DiskStation Manager (DSM)
- CWE-331
Not analysed yet 18 Sept 2026
CVE-2026-13684 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper output encoding in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- CWE-116
Not analysed yet 18 Sept 2026
CVE-2025-13392 CVE record

CVSS 8.1 High

Improper check for unusual conditions in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- CWE-754
Not analysed yet 27 May 2026
CVE-2024-5401 CVE record

CVSS 4.3 Medium

Synology DiskStation Manager (DSM): Improper control of dynamically-managed code resources vulnerability in WebAPI component…
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
- CWE-913
Not analysed yet 4 Dec 2025
CVE-2024-45539 CVE record

CVSS 7.5 High

Out-of-bounds write in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
- Memory corruption
Not analysed yet 4 Dec 2025
CVE-2024-45538 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Cross-site request forgery in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
- Cross-site request forgery (CSRF)
Not analysed yet 4 Dec 2025
CVE-2025-1021 CVE record

CVSS 7.5 High

Missing authorization in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Broken access control
Not analysed yet 23 Apr 2025
CVE-2024-50629 CVE record

CVSS 5.3 Medium

Improper output encoding in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology BeeStation OS (BSM)
- CWE-116
Not analysed yet 19 Mar 2025
CVE-2024-10445 CVE record

CVSS 4.3 Medium

Improper certificate validation in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology BeeStation OS (BSM)
- Weak cryptography or TLS
Not analysed yet 19 Mar 2025
CVE-2024-10441 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper output encoding in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology BeeStation OS (BSM)
- CWE-116
Not analysed yet 19 Mar 2025
CVE-2024-10444 CVE record

CVSS 7.5 High

Improper certificate validation in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Weak cryptography or TLS
Not analysed yet 19 Mar 2025
CVE-2024-0854 CVE record

CVSS 5.4 Medium

Open redirect in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Open redirect
Not analysed yet 24 Jan 2024
CVE-2023-2729 CVE record

CVSS 5.9 Medium

Synology DiskStation Manager (DSM): Use of insufficiently random values vulnerability in User Management Functionality in…
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
Not analysed yet 13 Jun 2023
CVE-2023-0142 CVE record

CVSS 6.5 Medium

Uncontrolled search path in Synology DiskStation Manager (DSM) and others
- Synology DiskStation Manager (DSM)
- Synology Unified Controller (DSMUC)
- CWE-427
Not analysed yet 13 Jun 2023
CVE-2022-27622 CVE record

CVSS 4.1 Medium

Server-side request forgery in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Server-side request forgery (SSRF)
Not analysed yet 25 Oct 2022
CVE-2022-27623 CVE record

CVSS 7.4 High

Missing authentication in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Authentication bypass
Not analysed yet 25 Oct 2022
CVE-2022-3576 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 20 Oct 2022
CVE-2022-27624 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Buffer overflow in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 20 Oct 2022
CVE-2022-27625 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Buffer overflow in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 20 Oct 2022
CVE-2022-27626 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Race condition in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Race condition
Not analysed yet 20 Oct 2022
CVE-2022-27616 CVE record

CVSS 7.2 High

OS command injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Command injection
Not analysed yet 3 Aug 2022
CVE-2022-22684 CVE record

CVSS 7.2 High

OS command injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Command injection
Not analysed yet 28 Jul 2022
CVE-2022-27610 CVE record

CVSS 6.5 Medium

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 27 Jul 2022
CVE-2022-22687 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Buffer overflow in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 25 Mar 2022
CVE-2022-22688 CVE record

CVSS 8.8 High

Command injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Command injection
Not analysed yet 25 Mar 2022
CVE-2022-22679 CVE record

CVSS 6.5 Medium

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 7 Feb 2022
CVE-2021-43929 CVE record

CVSS 6.5 Medium

Injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Other injection
Not analysed yet 7 Feb 2022
CVE-2021-43927 CVE record

CVSS 4.7 Medium

SQL injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- SQL injection
Not analysed yet 7 Feb 2022
CVE-2021-43926 CVE record

CVSS 4.7 Medium

SQL injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- SQL injection
Not analysed yet 7 Feb 2022
CVE-2021-43925 CVE record

CVSS 4.7 Medium

SQL injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- SQL injection
Not analysed yet 7 Feb 2022
CVE-2022-22680 CVE record

CVSS 5.3 Medium

Information disclosure in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Information disclosure
Not analysed yet 7 Feb 2022
CVE-2021-29084 CVE record

CVSS 7.5 High

Injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Other injection
Not analysed yet 23 Jun 2021
CVE-2021-29085 CVE record

CVSS 8.6 High

Injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Other injection
Not analysed yet 23 Jun 2021
CVE-2021-29087 CVE record

CVSS 7.5 High

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 23 Jun 2021
CVE-2021-27649 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 23 Jun 2021
CVE-2021-29086 CVE record

CVSS 5.3 Medium

Information disclosure in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Information disclosure
Not analysed yet 23 Jun 2021
CVE-2021-33182 CVE record

CVSS 5.0 Medium

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 1 Jun 2021
CVE-2021-29088 CVE record

CVSS 7.8 High

Path traversal in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Path traversal
Not analysed yet 1 Jun 2021
CVE-2021-29083 CVE record

CVSS 7.2 High

OS command injection in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Command injection
Not analysed yet 1 Apr 2021
CVE-2021-27646 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 12 Mar 2021
CVE-2021-26569 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Synology DiskStation Manager (DSM): Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology…
- Synology DiskStation Manager (DSM)
- CWE-366
Not analysed yet 12 Mar 2021
CVE-2021-27647 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds read in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Memory corruption
Not analysed yet 12 Mar 2021
CVE-2021-26566 CVE record

CVSS 8.3 High

Information disclosure in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Information disclosure
Not analysed yet 26 Feb 2021