Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Advisory: Synology DiskStation Manager (DSM) — Synology-SA-26:06 DSM Clear all filters
TI-2026-29286 CVE-2026-40539 · GHSA-mqfj-89cq-4gj9

Improper certificate validation in Synology DiskStation Manager

Priority LOW 32

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary fil…

CVSS 3.1HIGH 7.1 Adjacent network No auth User interaction EPSS 0.00117 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-295
TI-2026-29282 CVE-2026-40535 · GHSA-m49g-9jxp-9jqm

Path traversal in Synology DiskStation Manager

Priority LOW 35

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote at…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00503 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-22
TI-2026-29280 CVE-2026-40533 · GHSA-q9hh-8w48-6v49

An exposure of sensitive information through data queries vulnerability in Desktop API in…

Priority LOW 30

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-se…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00381 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-202
TI-2026-29284 CVE-2026-40537 · GHSA-7q9q-gp64-8j9m

Server-side request forgery in Synology DiskStation Manager

Priority LOW 20

A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00329 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-918
TI-2026-29283 CVE-2026-40536 · GHSA-p44h-mfjw-mpmg

Path traversal in Synology DiskStation Manager

Priority LOW 20

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote auth…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00423 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-22
TI-2026-29281 CVE-2026-40534 · GHSA-mr9f-32f3-48r2

Cross-site scripting in Synology DiskStation Manager

Priority LOW 24

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remot…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00269 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-79
TI-2026-29279 CVE-2026-40532 · GHSA-j58x-gp4x-7crp

A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology…

Priority LOW 29

A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive info…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00422 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-425
TI-2026-29278 CVE-2026-40531 · GHSA-hj3j-c7hh-gwq9

Integer overflow in Synology DiskStation Manager

Priority LOW 20

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-o…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00437 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-190
TI-2026-03496 CVE-2026-4036 · GHSA-7j66-q2g2-58mc

SQL injection in Synology DiskStation Manager

Priority LOW 29

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows rem…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00445 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-89
TI-2026-29277 CVE-2026-40530 · GHSA-j93c-qcgp-gv6m

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API…

Priority LOW 37

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to…

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00493 Published 2026-09-18 Fixed in 7.3.2-86009-2, 7.2.2-72806-7 +1 CWE-93