Synology DiskStation Manager

Name: Synology DiskStation Manager
Brand: Synology

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

6critical6high14medium3low

updated 2026-10-27

vulnerabilities (36)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-32746US	—	44.1% (99th)	Exploit	7.3.2-86009-3	2026-03-13	3 versions
CVE-2024-50629US	—	31.9% (98th)	Exploit	7.2.2-72806-3	2025-03-19	2 versions
CVE-2024-10441US	—	1.25% (69th)	Exploit	7.2.2-72806-1	2025-03-19	2 versions
CVE-2021-31439US	high8.8	2.33% (83rd)	—	no fix	2021-05-21	≤ 6.1.1-15101-4
CVE-2022-22679US	medium4.9	1.16% (67th)	—	7.0.1-42218-2	2022-02-07	2 versions
CVE-2022-22680US	high7.5	1.14% (66th)	—	7.0.1-42218-2	2022-02-07	2 versions
CVE-2021-43927US	critical9.8	0.88% (59th)	—	7.0.1-42218-2	2022-02-07	2 versions
CVE-2021-43926US	critical9.8	0.88% (59th)	—	7.0.1-42218-2	2022-02-07	2 versions
CVE-2021-43925US	critical9.8	0.88% (59th)	—	6.2.4-25556-3	2022-02-07	2 versions
CVE-2026-13639US	critical9.8	0.69% (53rd)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-13684US	critical9.8	0.62% (50th)	—	7.4-90075	2026-09-18	4 versions
CVE-2021-43929US	medium5.4	0.60% (48th)	—	6.2.4-25556-3	2022-02-07	2 versions
CVE-2025-13392US	critical9.8	0.53% (45th)	—	7.2.2-72806-5	2026-05-27	2 versions
CVE-2025-1021US	—OT elevated	0.53% (45th)	—	7.2.2-72806-3	2025-04-23	3 versions
CVE-2026-6205US	high8.1	0.52% (44th)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-40535US	medium6.5	0.50% (43rd)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2026-13673US	high8.8	0.50% (42nd)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-40530US	high8.0	0.49% (42nd)	—	7.2.2-72806-7	2026-09-18	3 versions
CVE-2026-4036US	medium6.5	0.45% (38th)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2026-40531US	medium4.3	0.44% (38th)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2026-40536US	medium4.3	0.42% (36th)	—	7.2.2-72806-7	2026-09-18	3 versions
CVE-2026-40532US	medium6.5	0.42% (36th)	—	7.2.2-72806-7	2026-09-18	3 versions
CVE-2026-13635US	medium5.3	0.40% (34th)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-40533US	medium5.3	0.38% (32nd)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2024-10445US	medium5.3	0.38% (32nd)	—	7.2.2-72806-3	2025-03-19	2 versions
CVE-2026-13683US	low2.7	0.38% (32nd)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-40538US	low3.7	0.37% (31st)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2026-40537US	medium4.3	0.33% (26th)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2026-13666US	low3.5	0.30% (22nd)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-13623US	medium4.8	0.29% (21st)	—	7.4-90075	2026-09-18	4 versions
CVE-2026-40534US	medium5.4	0.27% (19th)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2024-10444US	—	0.26% (17th)	—	7.2.2-72806-3	2025-03-19	6 versions
CVE-2026-32772US	medium4.7	0.19% (9th)	—	7.3.2-86009-3	2026-03-16	3 versions
CVE-2026-40539US	high7.1	0.12% (2nd)	—	7.3.2-86009-2	2026-09-18	3 versions
CVE-2025-5293US	—	—	—	4.15.9-0644	—	2 versions
CVE-2026-40540US	—	—	—	7.3-81180	—	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')5 CVEs
CWE-116Improper Encoding or Escaping of Output4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-295Improper Certificate Validation3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')2 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')1 CVEs
CWE-122Heap-based Buffer Overflow1 CVEs

sources (3)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)35 CVEs
EUEU Vulnerability Database (ENISA)1 CVEs
NLNCSC-NL (CSAF)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan