DM
Product
DiskStation Manager (DSM)
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 11Low 3
Watch
Add DiskStation Manager (DSM) to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13639 | 9.8 | Sep 18 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2026-13684 | 9.8 | Sep 18 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2025-13392 | 9.8 | May 27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not… Affected: 7.3 before 7.3.1-86003-1; 7.2.2 before 7.2.2-72806-5 |
| CVE-2022-27624 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-27625 | 9.8 | Oct 20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-27623 | 9.1 | Oct 25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote attackers to read… Affected: before 7.1-42661 |
| CVE-2026-13673 | 8.8 | Sep 18 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2026-6205 | 8.1 | Sep 18 | An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2022-27626 | 8.1 | Oct 20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functionality of… Affected: before 7.1.1-42962-2 |
| CVE-2026-40530 | 8.0 | Sep 18 | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2022-3576 | 7.5 | Oct 20 | A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management Affected: before 7.1.1-42962-2 |
| CVE-2022-27616 | 7.2 | Aug 3 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before… Affected: before 7.0.1-42218-3 |
| CVE-2026-40539 | 7.1 | Sep 18 | An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40535 | 6.5 | Sep 18 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40532 | 6.5 | Sep 18 | A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-4036 | 6.5 | Sep 18 | An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40534 | 5.4 | Sep 18 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40533 | 5.3 | Sep 18 | An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-13635 | 5.3 | Sep 18 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2026-13623 | 4.8 | Sep 18 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12,… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2026-40537 | 4.3 | Sep 18 | A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40536 | 4.3 | Sep 18 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-40531 | 4.3 | Sep 18 | An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote… Affected: 7.3 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2022-27622 | 4.3 | Oct 25 | Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to access… Affected: before 7.1-42661 |
| CVE-2026-40538 | 3.7 | Sep 18 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and… Affected: 7.3.2 before 7.3.2-86009-2; 7.2.2 before 7.2.2-72806-7; 7.2.1 before 7.2.1-69057-10 |
| CVE-2026-13666 | 3.5 | Sep 18 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9,… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
| CVE-2026-13683 | 2.7 | Sep 18 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before… Affected: 7.4 before 7.4-90075; 7.3.2 before 7.3.2-86009-4; 7.2.2 before 7.2.2-72806-9; 7.2.1 before 7.2.1-69057-12 |
Showing 27