Known vulnerabilities in DiskStation Manager (DSM)
Vendor:
Synology Inc.
Software:
DiskStation Manager (DSM)
Software CPE:
cpe:2.3:a:synology:diskstation_manager_dsm:*:*:*:*:*:*:*:*
Website:
https://www.synology.com/
Total vulnerabilities:
39
Public exploits:
1
Known exploited (KEV):
0
Breakdown by Severity Chart
7.2.1-69057-12
7.2.2-72806-9
7.3.2-86009-4
7.4-90075
7.3-81180
7.2.1-69057-10
7.2.2-72806-7
7.3.2-86009-2
7.2.2-72806-5
7.3.1-86003-1
7.1.1-42962-8
7.2.1-69057-7
7.2.2-72806-3
7.2.1-69057-6
7.2-64570-4
7.1.1-42962-7
6.2.4-25556-8
7.2.2-72806-1
7.1.1-42962
7.1.1-42951
5.2.2-5644
7.1-42661
7.1-42621
7.0.1-42218
7.0.1-42214
7.0-41890
7.0-41882
6.2.3 25426-2
6.2.3-25426-3
6.2.4-25556
6.2.4-25554
6.2.3-25426-2
6.2.3-25426-1
6.2.3-25426
6.2.3-25423
6.2.2-24922-4
6.2.2-24922-3
6.2.2-24922-2
6.2.2-24922-1
6.2.2-24922
6.2.1-23824-6
6.2.1-23824-4
6.2.1-23824-3
6.2.1-23824-2
6.2.1-23824-1
6.2.1-23824
6.1.7-15284-3
5.2-5967-9
5.0-4493-5
5.0-4493-4
5.0-4493-3
5.0-4493-2
5.0-4493-1
5.0-4493
5.0-4482
5.0-4458-2
5.0-4458-1
5.0-4458
4.3-3827-7
4.3-3827-6
4.3-3827-5
4.3-3827-4
4.3-3827-3
4.3-3827-2
4.3-3827-1
4.3-3827
4.3-3810-4
4.3-3810-3
4.3-3810-2
4.3-3810-1
4.3-3810
4.3-3776-3
4.3-3776-2
4.3-3776-1
4.3-3776
6.2-23739-2
6.2-23739-1
6.2-23739
6.1.7-15284-2
6.1.7-15284-1
6.1.7-15284
6.1.6-15266-1
6.1.6-15266
6.1.5-15254-1
6.1.5-15254
6.1.4-15217-5
6.1.4-15217-4
6.1.4-15217-3
6.1.4-15217-2
6.1.4-15217-1
6.1.4-15217
6.1.3-15152-8
6.1.3-15152-7
6.1.3-15152-6
6.1.3-15152-5
6.1.3-15152-4
6.1.3-15152-3
6.1.3-15152-2
6.1.3-15152-1
6.1.3-15152
6.1.2-15132-1
6.1.2-15132
6.1.1-15101-4
6.1.1-15101-3
6.1.1-15101-2
6.1.1-15101-1
6.1.1-15101
6.1-15047-2
6.1-15047-1
6.1-15047
6.0.3-8754-8
6.0.3-8754-7
6.0.3-8754-6
6.0.3-8754-5
6.0.3-8754-4
6.0.3-8754-3
6.0.3-8754-2
6.0.3-8754-1
6.0.3-8754
6.0.2-8451-11
6.0.2-8451-10
6.0.2-8451-9
6.0.2-8451-8
6.0.2-8451-7
6.0.2-8451-6
6.0.2-8451-5
6.0.2-8451-4
6.0.2-8451-3
6.0.2-8451-2
6.0.2-8451-1
6.0.2-8451
6.0.1-7393-2
6.0.1-7393-1
6.0.1-7393
6.0-7321-7
6.0-7321-6
6.0-7321-5
6.0-7321-3
6.0-7321-2
6.0-7321-1
6.0-7321
5.2-5967-8
5.2-5967-7
5.2-5967-6
5.2-5967-5
5.2-5967-4
5.2-5967-3
5.2-5967-2
5.2-5967-1
5.2-5967
5.2-5644-8
5.2-5644-5
5.2-5644-3
5.2-5644-2
5.2-5644-1
5.2-5644
5.2-5592-4
5.2-5592-3
5.2-5592-2
5.2-5592-1
5.2-5592
5.2-5565-2
5.2-5565-1
5.2-5565
5.1-5055
5.1-5022-5
5.1-5022-4
5.1-5022-3
5.1-5022-2
5.1-5022-1
5.1-5022
5.1-5021-2
5.1-5021
5.1-5004-2
5.1-5004
5.0-4528-2
5.0-4528-1
5.0-4528
5.2
5.1
5.0
4.3
4.2
4.1
4.0
3.2
3.1
3.0
2.3
2.2
2.1
2.0
6.0.2
6.0
6.0.1
Vulnerabilities (39)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU151479 - Improper Encoding or Escaping of Output CVE-2026-13684 |
CWE-116 | High | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151480 - Insufficient Entropy CVE-2026-13639 |
CWE-331 | High | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151481 - Incorrect Permission Assignment for Critical Resource CVE-2026-13673 |
CWE-732 | Medium | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151482 - External Control of File Name or Path CVE-2026-6205 |
CWE-73 | Medium | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151483 - Improper Encoding or Escaping of Output CVE-2026-13635 |
CWE-116 | Medium | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151484 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-13623 |
CWE-79 | Low | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151485 - Improper Neutralization of CRLF Sequences ('CRLF Injection') CVE-2026-13666 |
CWE-93 | Low | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU151486 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-13683 |
CWE-89 | Low | 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 | 20.09.2026 |
SB2026092050 |
||
| #VU126273 - Improper Access Control CVE-2026-40540 |
CWE-284 | Low | 7.2.1-69057-10, 7.2.2-72806-7, 7.3-81180 | 16.04.2026 |
SB2026041619 |
||
| #VU126262 - Improper Neutralization of CRLF Sequences ('CRLF Injection') CVE-2026-40530 |
CWE-93 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126263 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-4036 |
CWE-89 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126264 - Integer overflow CVE-2026-40531 |
CWE-190 | Low | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126265 - Direct Request ('Forced Browsing') CVE-2026-40532 |
CWE-425 | Low | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126266 - Exposure of Sensitive Information Through Data Queries CVE-2026-40533 |
CWE-202 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126267 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-40534 |
CWE-79 | Low | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126268 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-40535 |
CWE-22 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126269 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-40536 |
CWE-22 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126270 - Server-Side Request Forgery (SSRF) CVE-2026-40537 |
CWE-918 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126271 - Improper Restriction of Excessive Authentication Attempts CVE-2026-40538 |
CWE-307 | Low | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
||
| #VU126272 - Improper Certificate Validation CVE-2026-40539 |
CWE-295 | Medium | 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 | 16.04.2026 |
SB2026041618 |
Showing elements 1 - 20 out of 39