Synology vulnerabilities

Every vulnerability this feed holds for Synology, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.

23 vulnerabilities tracked.

8.8 A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-74857 12 Nov 2026
8.8 An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM)… CVE-2026-18792 12 Nov 2026
8.8 An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5… CVE-2026-13672 12 Nov 2026
8.1 An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM)… CVE-2026-81584 12 Nov 2026
8.1 An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-19048 12 Nov 2026
8.1 An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before… CVE-2026-18596 12 Nov 2026
7.5 An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… CVE-2026-18633 12 Nov 2026
7.2 An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM)… CVE-2026-75785 12 Nov 2026
6.8 An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-86343 12 Nov 2026
6.5 An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before… CVE-2026-87801 12 Nov 2026
6.5 An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-16550 12 Nov 2026
6.5 A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before… CVE-2026-15198 12 Nov 2026
5.9 An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-15201 12 Nov 2026
5.4 An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM)… CVE-2026-92379 12 Nov 2026
5.4 An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before… CVE-2026-81557 12 Nov 2026
5.4 A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows… CVE-2026-19833 12 Nov 2026
5.4 An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM)… CVE-2026-13656 12 Nov 2026
5.3 A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows… CVE-2026-85098 12 Nov 2026
5.3 An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-124993 12 Nov 2026
4.3 A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… CVE-2026-81558 12 Nov 2026
4.3 A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… CVE-2026-77738 12 Nov 2026
4.3 An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM)… CVE-2026-74850 12 Nov 2026
4.3 A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… CVE-2026-19414 12 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Synology is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other vendors tracked here

Microsoft Linux Red Hat IBM Google n/a Apple Apache Software Foundation Oracle Corporation zephyrproject Unknown FFMPEG Fortinet Adobe Drupal SAP_SE Cisco Eclipse Foundation erlang OpenEMR go-vikunja hickory-dns n8n-io Grafana