Filtered by vendor Synology
Subscriptions
Total
356 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-40541 | 1 Synology | 1 Synology Chat Server | 2026-09-01 | 9 Critical |
| An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM. | ||||
| CVE-2026-9491 | 1 Synology | 1 Synology Chat Server | 2026-09-01 | 4.3 Medium |
| A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information. | ||||
| CVE-2026-9548 | 1 Synology | 1 Synology Chat Server | 2026-09-01 | 6.5 Medium |
| An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM. | ||||
| CVE-2026-4793 | 2 Microsoft, Synology | 2 Windows, Assistant | 2026-08-19 | 7.3 High |
| An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation. | ||||
| CVE-2025-12686 | 1 Synology | 2 Beestation Manager, Beestation Os | 2026-06-18 | 9.8 Critical |
| Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. | ||||
| CVE-2022-49036 | 1 Synology | 2 Active Backup For Business Recovery Media Creator, Synology Active Backup For Business Recovery Media Creator | 2026-06-10 | 7.8 High |
| An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors. | ||||
| CVE-2024-47273 | 1 Synology | 1 Hyper Backup | 2026-06-05 | 4.3 Medium |
| An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors. | ||||
| CVE-2024-47263 | 1 Synology | 1 Hyper Backup | 2026-06-05 | 4.1 Medium |
| An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors. | ||||
| CVE-2023-52951 | 1 Synology | 2 Note Station Client, Synology Note Station Client | 2026-06-05 | 5.9 Medium |
| A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential. | ||||
| CVE-2022-49042 | 1 Synology | 2 Hyper Backup Explorer, Synology Hyper Backup Explorer | 2026-06-05 | 7.8 High |
| An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors. | ||||
| CVE-2025-13392 | 1 Synology | 1 Diskstation Manager | 2026-06-02 | 8.1 High |
| Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN). | ||||
| CVE-2025-14713 | 1 Synology | 2 C2 Identity Edge Server, Diskstation Manager | 2026-06-02 | 7.5 High |
| An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server. | ||||
| CVE-2025-30028 | 1 Synology | 2 Active Backup For Business, Diskstation Manager | 2026-06-02 | 8.6 High |
| A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | ||||
| CVE-2025-10466 | 1 Synology | 3 Router Manager, Safe Access, Safeaccess | 2026-06-02 | 5.9 Medium |
| Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM. | ||||
| CVE-2024-11399 | 1 Synology | 2 Beedrive, Beedrive For Desktop | 2026-06-02 | 6.8 Medium |
| Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors. | ||||
| CVE-2026-2237 | 1 Synology | 2 Diskstation Manager, Storage Manager | 2026-06-02 | 6.2 Medium |
| A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information. | ||||
| CVE-2026-3091 | 1 Synology | 2 Presto Client, Synology Presto Client | 2026-06-02 | 6.7 Medium |
| An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer. | ||||
| CVE-2025-66592 | 1 Synology | 1 Active Backup For Business Agent | 2026-06-02 | 6.1 Medium |
| An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | ||||
| CVE-2025-66593 | 1 Synology | 1 Assistant | 2026-06-02 | 6.1 Medium |
| An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | ||||
| CVE-2025-13593 | 1 Synology | 1 Activeprotect Agent | 2026-06-02 | 6.1 Medium |
| Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation. | ||||