# cve.now: Synology

The newest entries naming Synology as an affected vendor (up to 200), of 317 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-40539](https://cve.now/CVE-2026-40539.md): An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and (CVSS 7.1)
- [CVE-2026-40538](https://cve.now/CVE-2026-40538.md): An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1- (CVSS 3.7)
- [CVE-2026-40535](https://cve.now/CVE-2026-40535.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manag (CVSS 6.5)
- [CVE-2026-40533](https://cve.now/CVE-2026-40533.md): An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69 (CVSS 5.3)
- [CVE-2026-40537](https://cve.now/CVE-2026-40537.md): A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280 (CVSS 4.3)
- [CVE-2026-40536](https://cve.now/CVE-2026-40536.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (CVSS 4.3)
- [CVE-2026-40534](https://cve.now/CVE-2026-40534.md): An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation M (CVSS 5.4)
- [CVE-2026-40532](https://cve.now/CVE-2026-40532.md): A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280 (CVSS 6.5)
- [CVE-2026-40531](https://cve.now/CVE-2026-40531.md): An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 (CVSS 4.3)
- [CVE-2026-4036](https://cve.now/CVE-2026-4036.md): An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation (CVSS 6.5)
- [CVE-2026-40530](https://cve.now/CVE-2026-40530.md): An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1 (CVSS 8.0)
- [CVE-2026-13683](https://cve.now/CVE-2026-13683.md): An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology Disk (CVSS 2.7)
- [CVE-2026-13623](https://cve.now/CVE-2026-13623.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation M (CVSS 4.8)
- [CVE-2026-13666](https://cve.now/CVE-2026-13666.md): An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7. (CVSS 3.5)
- [CVE-2026-6205](https://cve.now/CVE-2026-6205.md): An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280 (CVSS 8.1)
- [CVE-2026-13673](https://cve.now/CVE-2026-13673.md): An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057- (CVSS 8.8)
- [CVE-2026-13635](https://cve.now/CVE-2026-13635.md): An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280 (CVSS 5.3)
- [CVE-2026-13639](https://cve.now/CVE-2026-13639.md): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009 (CVSS 9.8)
- [CVE-2026-13684](https://cve.now/CVE-2026-13684.md): An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12… (CVSS 9.8)
- [CVE-2026-9548](https://cve.now/CVE-2026-9548.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Ser (CVSS 6.5)
- [CVE-2026-9491](https://cve.now/CVE-2026-9491.md): A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to (CVSS 4.3)
- [CVE-2026-40541](https://cve.now/CVE-2026-40541.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Ser (CVSS 9.0)
- [CVE-2026-4793](https://cve.now/CVE-2026-4793.md): An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files (CVSS 7.3)
- [CVE-2024-47263](https://cve.now/CVE-2024-47263.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Syn (CVSS 4.1)
- [CVE-2024-47273](https://cve.now/CVE-2024-47273.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyp (CVSS 4.3)
- [CVE-2022-49036](https://cve.now/CVE-2022-49036.md): An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Re (CVSS 7.8)
- [CVE-2022-49042](https://cve.now/CVE-2022-49042.md): An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3. (CVSS 7.8)
- [CVE-2023-52951](https://cve.now/CVE-2023-52951.md): A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle at (CVSS 5.9)
- [CVE-2026-2237](https://cve.now/CVE-2026-2237.md): A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1 (CVSS 6.2)
- [CVE-2025-66593](https://cve.now/CVE-2025-66593.md): An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricte (CVSS 6.1)
- [CVE-2025-66592](https://cve.now/CVE-2025-66592.md): An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrar (CVSS 6.1)
- [CVE-2025-30028](https://cve.now/CVE-2025-30028.md): A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. (CVSS 8.6)
- [CVE-2025-14713](https://cve.now/CVE-2025-14713.md): An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote at (CVSS 7.5)
- [CVE-2025-13593](https://cve.now/CVE-2025-13593.md): Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with res (CVSS 6.1)
- [CVE-2025-12686](https://cve.now/CVE-2025-12686.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-6 (CVSS 9.8)
- [CVE-2025-13392](https://cve.now/CVE-2025-13392.md): Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3 (CVSS 8.1)
- [CVE-2025-13167](https://cve.now/CVE-2025-13167.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Cont (CVSS 5.4)
- [CVE-2025-10466](https://cve.now/CVE-2025-10466.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access be (CVSS 5.9)
- [CVE-2024-47272](https://cve.now/CVE-2024-47272.md): Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows r (CVSS 2.7)
- [CVE-2024-47271](https://cve.now/CVE-2024-47271.md): Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 (CVSS 4.9)
- [CVE-2024-47270](https://cve.now/CVE-2024-47270.md): Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9 (CVSS 2.7)
- [CVE-2024-47269](https://cve.now/CVE-2024-47269.md): Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-1157 (CVSS 4.9)
- [CVE-2024-47268](https://cve.now/CVE-2024-47268.md): Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote (CVSS 4.9)
- [CVE-2024-47267](https://cve.now/CVE-2024-47267.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Sur (CVSS 2.7)
- [CVE-2024-11399](https://cve.now/CVE-2024-11399.md): Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13 (CVSS 6.8)
- [CVE-2023-52945](https://cve.now/CVE-2023-52945.md): Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local use (CVSS 7.8)
- [CVE-2021-47961](https://cve.now/CVE-2021-47961.md): A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence (CVSS 8.1)
- [CVE-2021-47960](https://cve.now/CVE-2021-47960.md): A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to (CVSS 6.5)
- [CVE-2026-3091](https://cve.now/CVE-2026-3091.md): An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary (CVSS 6.7)
- [CVE-2025-8074](https://cve.now/CVE-2025-8074.md): Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary (CVSS 5.6)
- [CVE-2025-54160](https://cve.now/CVE-2025-54160.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop be (CVSS 7.8)
- [CVE-2025-54159](https://cve.now/CVE-2025-54159.md): Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitr (CVSS 7.5)
- [CVE-2025-54158](https://cve.now/CVE-2025-54158.md): Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local user (CVSS 7.8)
- [CVE-2025-2848](https://cve.now/CVE-2025-2848.md): A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non (CVSS 6.3)
- [CVE-2025-29846](https://cve.now/CVE-2025-29846.md): A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. (CVSS 7.2)
- [CVE-2025-29845](https://cve.now/CVE-2025-29845.md): A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. (CVSS 4.3)
- [CVE-2025-29844](https://cve.now/CVE-2025-29844.md): A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. (CVSS 4.3)
- [CVE-2025-29843](https://cve.now/CVE-2025-29843.md): A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. (CVSS 5.4)
- [CVE-2024-5401](https://cve.now/CVE-2024-5401.md): Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1- (CVSS 4.3)
- [CVE-2024-45539](https://cve.now/CVE-2024-45539.md): Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology (CVSS 7.5)
- [CVE-2024-45538](https://cve.now/CVE-2024-45538.md): Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-728 (CVSS 9.6)
- [CVE-2024-13987](https://cve.now/CVE-2024-13987.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote a (CVSS 5.9)
- [CVE-2024-53288](https://cve.now/CVE-2024-53288.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology R (CVSS 5.9)
- [CVE-2024-53287](https://cve.now/CVE-2024-53287.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology (CVSS 5.9)
- [CVE-2024-53286](https://cve.now/CVE-2024-53286.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Syn (CVSS 7.2)
- [CVE-2025-4679](https://cve.now/CVE-2025-4679.md): A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspec (CVSS 6.5)
- [CVE-2025-1021](https://cve.now/CVE-2025-1021.md): Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 (CVSS 7.5)
- [CVE-2024-50631](https://cve.now/CVE-2024-50631.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology (CVSS 7.5)
- [CVE-2024-50630](https://cve.now/CVE-2024-50630.md): Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, (CVSS 7.5)
- [CVE-2024-50629](https://cve.now/CVE-2024-50629.md): Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology (CVSS 5.3)
- [CVE-2024-11131](https://cve.now/CVE-2024-11131.md): A vulnerability regarding out-of-bounds read is found in the video interface. (CVSS 9.8)
- [CVE-2024-10442](https://cve.now/CVE-2024-10442.md): Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 a (CVSS 10.0)
- [CVE-2024-10445](https://cve.now/CVE-2024-10445.md): Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology Disk (CVSS 4.3)
- [CVE-2024-10441](https://cve.now/CVE-2024-10441.md): Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synol (CVSS 9.8)
- [CVE-2024-10444](https://cve.now/CVE-2024-10444.md): Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057- (CVSS 7.5)
- [CVE-2024-47266](https://cve.now/CVE-2024-47266.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Ac (CVSS 2.7)
- [CVE-2024-47265](https://cve.now/CVE-2024-47265.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Syno (CVSS 6.5)
- [CVE-2024-47264](https://cve.now/CVE-2024-47264.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Acti (CVSS 4.9)
- [CVE-2024-4464](https://cve.now/CVE-2024-4464.md): Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and (CVSS 7.5)
- [CVE-2024-53285](https://cve.now/CVE-2024-53285.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology (CVSS 5.9)
- [CVE-2024-53284](https://cve.now/CVE-2024-53284.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in (CVSS 5.9)
- [CVE-2024-53283](https://cve.now/CVE-2024-53283.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in S (CVSS 5.9)
- [CVE-2024-53282](https://cve.now/CVE-2024-53282.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality (CVSS 5.9)
- [CVE-2024-53281](https://cve.now/CVE-2024-53281.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology (CVSS 5.9)
- [CVE-2024-53279](https://cve.now/CVE-2024-53279.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology (CVSS 5.9)
- [CVE-2024-53280](https://cve.now/CVE-2024-53280.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functional (CVSS 5.9)
- [CVE-2023-52944](https://cve.now/CVE-2023-52944.md): Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allo (CVSS 4.3)
- [CVE-2023-52943](https://cve.now/CVE-2023-52943.md): Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 a (CVSS 4.3)
- [CVE-2024-11398](https://cve.now/CVE-2024-11398.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router M (CVSS 8.1)
- [CVE-2024-10443](https://cve.now/CVE-2024-10443.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo (CVSS 9.8)
- [CVE-2023-52949](https://cve.now/CVE-2023-52949.md): Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent befo (CVSS 5.5)
- [CVE-2023-52948](https://cve.now/CVE-2023-52948.md): Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 (CVSS 5.0)
- [CVE-2023-52947](https://cve.now/CVE-2023-52947.md): Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3 (CVSS 4.0)
- [CVE-2023-52950](https://cve.now/CVE-2023-52950.md): Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows (CVSS 5.3)
- [CVE-2022-49041](https://cve.now/CVE-2022-49041.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Dri (CVSS 4.4)
- [CVE-2022-49040](https://cve.now/CVE-2022-49040.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Driv (CVSS 4.4)
- [CVE-2022-49039](https://cve.now/CVE-2022-49039.md): Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users wit (CVSS 6.7)
- [CVE-2022-49038](https://cve.now/CVE-2022-49038.md): Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 (CVSS 7.8)
- [CVE-2022-49037](https://cve.now/CVE-2022-49037.md): Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allow (CVSS 6.5)
- [CVE-2023-52946](https://cve.now/CVE-2023-52946.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client befor (CVSS 8.2)
- [CVE-2024-39350](https://cve.now/CVE-2024-39350.md): A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. (CVSS 7.5)
- [CVE-2024-39348](https://cve.now/CVE-2024-39348.md): Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1 (CVSS 7.5)
- [CVE-2024-39347](https://cve.now/CVE-2024-39347.md): Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 (CVSS 5.9)
- [CVE-2024-39352](https://cve.now/CVE-2024-39352.md): A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. (CVSS 4.9)
- [CVE-2024-39351](https://cve.now/CVE-2024-39351.md): A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP con (CVSS 7.2)
- [CVE-2024-39349](https://cve.now/CVE-2024-39349.md): A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it (CVSS 9.8)
- [CVE-2023-47803](https://cve.now/CVE-2023-47803.md): A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings f (CVSS 5.3)
- [CVE-2023-47802](https://cve.now/CVE-2023-47802.md): A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP bloc (CVSS 7.2)
- [CVE-2024-5463](https://cve.now/CVE-2024-5463.md): A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. (CVSS 6.5)
- [CVE-2024-29241](https://cve.now/CVE-2024-29241.md): Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows rem (CVSS 9.9)
- [CVE-2024-29240](https://cve.now/CVE-2024-29240.md): Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows (CVSS 4.3)
- [CVE-2024-29239](https://cve.now/CVE-2024-29239.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi compo (CVSS 5.4)
- [CVE-2024-29238](https://cve.now/CVE-2024-29238.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component i (CVSS 5.4)
- [CVE-2024-29237](https://cve.now/CVE-2024-29237.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in (CVSS 5.4)
- [CVE-2024-29236](https://cve.now/CVE-2024-29236.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component i (CVSS 5.4)
- [CVE-2024-29235](https://cve.now/CVE-2024-29235.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in S (CVSS 5.4)
- [CVE-2024-29234](https://cve.now/CVE-2024-29234.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synolog (CVSS 5.4)
- [CVE-2024-29233](https://cve.now/CVE-2024-29233.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synolo (CVSS 5.4)
- [CVE-2024-29232](https://cve.now/CVE-2024-29232.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synolog (CVSS 5.4)
- [CVE-2024-29231](https://cve.now/CVE-2024-29231.md): Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 a (CVSS 5.4)
- [CVE-2024-29230](https://cve.now/CVE-2024-29230.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi compon (CVSS 5.4)
- [CVE-2024-29229](https://cve.now/CVE-2024-29229.md): Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 a (CVSS 7.7)
- [CVE-2024-29228](https://cve.now/CVE-2024-29228.md): Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 all (CVSS 7.7)
- [CVE-2024-29227](https://cve.now/CVE-2024-29227.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in (CVSS 5.4)
- [CVE-2024-0854](https://cve.now/CVE-2024-0854.md): URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2. (CVSS 5.4)
- [CVE-2023-5748](https://cve.now/CVE-2023-5748.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4. (CVSS 3.3)
- [CVE-2023-5746](https://cve.now/CVE-2023-5746.md): A vulnerability regarding use of externally-controlled format string is found in the cgi component. (CVSS 9.8)
- [CVE-2023-41741](https://cve.now/CVE-2023-41741.md): Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346 (CVSS 5.3)
- [CVE-2023-41740](https://cve.now/CVE-2023-41740.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SR (CVSS 5.3)
- [CVE-2023-41739](https://cve.now/CVE-2023-41739.md): Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote aut (CVSS 4.9)
- [CVE-2023-41738](https://cve.now/CVE-2023-41738.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality i (CVSS 7.2)
- [CVE-2023-2729](https://cve.now/CVE-2023-2729.md): Use of insufficiently random values vulnerability in User Management Functionality in Synology DiskStation Manager (DSM) before 7.2-64561 al (CVSS 5.9)
- [CVE-2023-0142](https://cve.now/CVE-2023-0142.md): Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8 (CVSS 6.5)
- [CVE-2023-32956](https://cve.now/CVE-2023-32956.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI component in Synology Router (CVSS 9.8)
- [CVE-2023-32955](https://cve.now/CVE-2023-32955.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DHCP Client Functionality in Syn (CVSS 8.1)
- [CVE-2023-0077](https://cve.now/CVE-2023-0077.md): Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows r (CVSS 6.5)
- [CVE-2022-43932](https://cve.now/CVE-2022-43932.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synolog (CVSS 7.5)
- [CVE-2022-43931](https://cve.now/CVE-2022-43931.md): Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote (CVSS 10.0)
- [CVE-2022-43748](https://cve.now/CVE-2022-43748.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto (CVSS 5.8)
- [CVE-2022-43749](https://cve.now/CVE-2022-43749.md): Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote auth (CVSS 4.3)
- [CVE-2022-27622](https://cve.now/CVE-2022-27622.md): Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allo (CVSS 4.1)
- [CVE-2022-27623](https://cve.now/CVE-2022-27623.md): Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7. (CVSS 7.4)
- [CVE-2022-3576](https://cve.now/CVE-2022-3576.md): A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. (CVSS 5.3)
- [CVE-2022-27624](https://cve.now/CVE-2022-27624.md): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption function (CVSS 10.0)
- [CVE-2022-27625](https://cve.now/CVE-2022-27625.md): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functio (CVSS 10.0)
- [CVE-2022-27626](https://cve.now/CVE-2022-27626.md): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessio (CVSS 10.0)
- [CVE-2022-27621](https://cve.now/CVE-2022-27621.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before (CVSS 5.5)
- [CVE-2022-27620](https://cve.now/CVE-2022-27620.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befo (CVSS 6.8)
- [CVE-2022-27619](https://cve.now/CVE-2022-27619.md): Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 (CVSS 6.8)
- [CVE-2022-27618](https://cve.now/CVE-2022-27618.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyze (CVSS 6.8)
- [CVE-2022-27617](https://cve.now/CVE-2022-27617.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before (CVSS 5.0)
- [CVE-2022-27616](https://cve.now/CVE-2022-27616.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology Dis (CVSS 7.2)
- [CVE-2022-27611](https://cve.now/CVE-2022-27611.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station b (CVSS 5.4)
- [CVE-2022-27612](https://cve.now/CVE-2022-27612.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4 (CVSS 7.3)
- [CVE-2022-22683](https://cve.now/CVE-2022-22683.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1- (CVSS 10.0)
- [CVE-2022-27614](https://cve.now/CVE-2022-27614.md): Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows rem (CVSS 5.3)
- [CVE-2022-22685](https://cve.now/CVE-2022-22685.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server b (CVSS 8.7)
- [CVE-2022-27613](https://cve.now/CVE-2022-27613.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV S (CVSS 8.3)
- [CVE-2022-22684](https://cve.now/CVE-2022-22684.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Syn (CVSS 7.2)
- [CVE-2022-27615](https://cve.now/CVE-2022-27615.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before (CVSS 7.7)
- [CVE-2022-27610](https://cve.now/CVE-2022-27610.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man (CVSS 6.5)
- [CVE-2022-22686](https://cve.now/CVE-2022-22686.md): Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users (CVSS 6.5)
- [CVE-2022-22682](https://cve.now/CVE-2022-22682.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar (CVSS 6.5)
- [CVE-2022-22681](https://cve.now/CVE-2022-22681.md): Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass s (CVSS 8.1)
- [CVE-2022-22687](https://cve.now/CVE-2022-22687.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation (CVSS 9.8)
- [CVE-2022-22688](https://cve.now/CVE-2022-22688.md): Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology (CVSS 8.8)
- [CVE-2022-22679](https://cve.now/CVE-2022-22679.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskS (CVSS 6.5)
- [CVE-2021-43929](https://cve.now/CVE-2021-43929.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in (CVSS 6.5)
- [CVE-2021-43928](https://cve.now/CVE-2021-43928.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving compo (CVSS 9.9)
- [CVE-2021-43927](https://cve.now/CVE-2021-43927.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in S (CVSS 4.7)
- [CVE-2021-43926](https://cve.now/CVE-2021-43926.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo (CVSS 4.7)
- [CVE-2021-43925](https://cve.now/CVE-2021-43925.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synolo (CVSS 4.7)
- [CVE-2022-22680](https://cve.now/CVE-2022-22680.md): Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42 (CVSS 5.3)
- [CVE-2021-29084](https://cve.now/CVE-2021-29084.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report (CVSS 7.5)
- [CVE-2021-29085](https://cve.now/CVE-2021-29085.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management (CVSS 8.6)
- [CVE-2021-29087](https://cve.now/CVE-2021-29087.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man (CVSS 7.5)
- [CVE-2021-27649](https://cve.now/CVE-2021-27649.md): Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote at (CVSS 9.8)
- [CVE-2021-29086](https://cve.now/CVE-2021-29086.md): Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6. (CVSS 5.3)
- [CVE-2021-34808](https://cve.now/CVE-2021-34808.md): Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to acce (CVSS 5.8)
- [CVE-2021-34809](https://cve.now/CVE-2021-34809.md): Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology D (CVSS 9.9)
- [CVE-2021-34810](https://cve.now/CVE-2021-34810.md): Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated use (CVSS 9.9)
- [CVE-2021-34811](https://cve.now/CVE-2021-34811.md): Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote (CVSS 5.0)
- [CVE-2021-34812](https://cve.now/CVE-2021-34812.md): Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensit (CVSS 5.8)
- [CVE-2021-29089](https://cve.now/CVE-2021-29089.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo (CVSS 9.8)
- [CVE-2021-29090](https://cve.now/CVE-2021-29090.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Statio (CVSS 7.2)
- [CVE-2021-29091](https://cve.now/CVE-2021-29091.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo (CVSS 7.7)
- [CVE-2021-33181](https://cve.now/CVE-2021-33181.md): Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticate (CVSS 6.6)
- [CVE-2021-33182](https://cve.now/CVE-2021-33182.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation (CVSS 5.0)
- [CVE-2021-33184](https://cve.now/CVE-2021-33184.md): Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote (CVSS 7.7)
- [CVE-2021-33183](https://cve.now/CVE-2021-33183.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synolo (CVSS 7.9)
- [CVE-2021-29088](https://cve.now/CVE-2021-29088.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before (CVSS 7.8)
- [CVE-2021-29092](https://cve.now/CVE-2021-29092.md): Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allo (CVSS 8.8)
- [CVE-2021-33180](https://cve.now/CVE-2021-33180.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server (CVSS 7.3)
- [CVE-2021-31439](https://cve.now/CVE-2021-31439.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. (CVSS 8.8)
- [CVE-2021-27648](https://cve.now/CVE-2021-27648.md): Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-280 (CVSS 9.0)
- [CVE-2021-29083](https://cve.now/CVE-2021-29083.md): Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager (DSM) before 6. (CVSS 7.2)
- [CVE-2021-27646](https://cve.now/CVE-2021-27646.md): Use After Free vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers (CVSS 9.8)
- [CVE-2021-26569](https://cve.now/CVE-2021-26569.md): Race Condition within a Thread vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows r (CVSS 9.8)
- [CVE-2021-27647](https://cve.now/CVE-2021-27647.md): Out-of-bounds Read vulnerability in iscsi\_snapshot\_comm\_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attack (CVSS 9.8)
- [CVE-2021-26566](https://cve.now/CVE-2021-26566.md): Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 all (CVSS 8.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/synology
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.