Filtered by vendor Synology
Subscribe
Total
352 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-2237 | 1 Synology | 2 Diskstation Manager, Storage Manager | 2026-10-26 | N/A | 6.2 MEDIUM |
| A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. | |||||
| CVE-2026-4793 | 2 Microsoft, Synology | 2 Windows, Assistant | 2026-10-23 | N/A | 7.3 HIGH |
| An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation. | |||||
| CVE-2025-12686 | 1 Synology | 1 Beestation Os | 2026-10-07 | N/A | 9.8 CRITICAL |
| Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. | |||||
| CVE-2025-13167 | 1 Synology | 2 Contacts, Diskstation Manager | 2026-10-07 | N/A | 5.4 MEDIUM |
| Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors. | |||||
| CVE-2025-66593 | 1 Synology | 1 Assistant | 2026-10-07 | N/A | 6.1 MEDIUM |
| An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2025-13593 | 1 Synology | 1 Activeprotect Agent | 2026-10-07 | N/A | 6.1 MEDIUM |
| Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2025-66592 | 1 Synology | 1 Active Backup For Business Agent | 2026-10-07 | N/A | 6.1 MEDIUM |
| An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | |||||
| CVE-2025-13392 | 1 Synology | 1 Diskstation Manager | 2026-10-07 | N/A | 8.1 HIGH |
| Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN). | |||||
| CVE-2025-14713 | 1 Synology | 2 C2 Identity Edge Server, Diskstation Manager | 2026-10-07 | N/A | 7.5 HIGH |
| An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. | |||||
| CVE-2025-10466 | 1 Synology | 2 Router Manager, Safe Access | 2026-10-07 | N/A | 5.9 MEDIUM |
| Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM. | |||||
| CVE-2025-30028 | 1 Synology | 2 Active Backup For Business, Diskstation Manager | 2026-10-07 | N/A | 8.6 HIGH |
| A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | |||||
| CVE-2023-52945 | 1 Synology | 1 Beedrive | 2026-09-26 | N/A | 7.8 HIGH |
| Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors. | |||||
| CVE-2024-45538 | 1 Synology | 2 Diskstation Manager, Diskstation Manager Unified Controller | 2026-09-26 | N/A | 9.6 CRITICAL |
| Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors. | |||||
| CVE-2024-45539 | 1 Synology | 2 Diskstation Manager, Diskstation Manager Unified Controller | 2026-09-26 | N/A | 7.5 HIGH |
| Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors. | |||||
| CVE-2024-5401 | 1 Synology | 2 Diskstation Manager, Diskstation Manager Unified Controller | 2026-09-26 | N/A | 4.3 MEDIUM |
| Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors. | |||||
| CVE-2025-54160 | 1 Synology | 1 Beedrive | 2026-09-25 | N/A | 7.8 HIGH |
| Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. | |||||
| CVE-2025-54158 | 1 Synology | 1 Beedrive | 2026-09-25 | N/A | 7.8 HIGH |
| Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors. | |||||
| CVE-2025-54159 | 1 Synology | 1 Beedrive | 2026-09-25 | N/A | 7.5 HIGH |
| Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors. | |||||
| CVE-2025-29846 | 1 Synology | 1 Router Manager | 2026-09-25 | N/A | 7.2 HIGH |
| A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. | |||||
| CVE-2025-29843 | 1 Synology | 1 Router Manager | 2026-09-25 | N/A | 5.4 MEDIUM |
| A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. | |||||