CVE-2026-19833

Synology DiskStation Manager (DSM) contains a missing authorization vulnerability in the ACL API affecting versions prior to 7.3.2-86009-5 and 7.4.1-90080 . This flaw allows remote authenticated users to perform unauthorized read or write operations on specific files. No specific exploit details ...

CVE-2026-13656

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-13656

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of input during web page generation in the Audio Player component. This vulnerability allows remote authenticated users to read or write specific files . Remediation is ...

EUVD-2026-124193

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files...

CVE-2026-15201

Synology DiskStation Manager (DSM) is vulnerable to an improper certificate validation flaw in the Support Form component. This vulnerability exists in versions prior to 7.3.2-86009-5 and 7.4.1-90080-1 . A man-in-the-middle (MITM) attacker can exploit this during support form submission to read a...

EUVD-2026-124192

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

CVE-2026-15201

An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission...

CVE-2026-87801

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

CVE-2026-87801

Synology DiskStation Manager (DSM) is vulnerable to an insertion of sensitive information into sent data within the API framework . This flaw allows remote authenticated users to read arbitrary files on the affected system. The vulnerability impacts versions prior to 7.3.2-86009-5 and 7.4.1-90080...

EUVD-2026-124191

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files...

EUVD-2026-124189

A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks...

CVE-2026-86343

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks...

EUVD-2026-124188

An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-86343

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-5 are vulnerable to an improper neutralization of CRLF sequences in the SNMP API . This flaw allows remote authenticated users with administrator privileges to perform arbitrary file read/write operations and execute...

EUVD-2026-124185

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files a...

EUVD-2026-124183

An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks...

EUVD-2026-124182

A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-74857

A missing critical step in authentication vulnerability exists in the Auth API of Synology DiskStation Manager (DSM) . This flaw affects versions prior to 7.3.2-86009-5 and 7.4.1-90080-1 . Remote authenticated users can exploit this vulnerability to read or write arbitrary files and perform denia...

CVE-2026-18792

The Synology DiskStation Manager (DSM) is affected by an improper limitation of a pathname to a restricted directory vulnerability within the Sharing API . This flaw exists in versions prior to 7.3.2-86009-5 and 7.4.1-90080-5 . Remote authenticated users can exploit this to read or write arbitrar...

CVE-2026-18792

An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...