CVE-2026-81557

A vulnerability in the DSMNotify component of Synology DiskStation Manager (DSM) allows remote authenticated users to read or write specific files. This is caused by improper neutralization of input during web page generation (CWE-79). The issue affects DSM versions prior to 7.3.2-86009-5 and 7.4...

EUVD-2026-124195

An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-19833

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

EUVD-2026-124194

A missing authorization vulnerability in the ACL API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-19833

Synology DiskStation Manager (DSM) contains a missing authorization vulnerability in the ACL API affecting versions prior to 7.3.2-86009-5 and 7.4.1-90080 . This flaw allows remote authenticated users to perform unauthorized read or write operations on specific files. No specific exploit details ...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of input during web page generation in the Audio Player component. This vulnerability allows remote authenticated users to read or write specific files . Remediation is ...

EUVD-2026-124193

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-15201

Synology DiskStation Manager (DSM) is vulnerable to an improper certificate validation flaw in the Support Form component. This vulnerability exists in versions prior to 7.3.2-86009-5 and 7.4.1-90080-1 . A man-in-the-middle (MITM) attacker can exploit this during support form submission to read a...

EUVD-2026-124192

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

CVE-2026-15201

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

CVE-2026-87801

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-87801

Synology DiskStation Manager (DSM) is vulnerable to an insertion of sensitive information into sent data within the API framework . This flaw allows remote authenticated users to read arbitrary files on the affected system. The vulnerability impacts versions prior to 7.3.2-86009-5 and 7.4.1-90080...

EUVD-2026-124191

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

EUVD-2026-124189

A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks...

CVE-2026-86343

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-86343

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-5 are vulnerable to an improper neutralization of CRLF sequences in the SNMP API . This flaw allows remote authenticated users with administrator privileges to perform arbitrary file read/write operations and execute...

EUVD-2026-124188

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks...

EUVD-2026-124185

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files a...

EUVD-2026-124183

An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks...