4
CVEs
1
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Diskstation Manager
81
Router Manager
44
Photo Station
30
Vs960Hd Firmware
22
PHP
21
Diskstation Manager Unified Controller
20
Debian Linux
18
Leap
16
Opensuse
16
Surveillance Station
15
Ubuntu Linux
15
Fedora
15
Skynas
14
Skynas Firmware
13
Calendar
10
Web Gateway
8
Download Station
8
Quay
7
Tc500 Firmware
7
Software Collections
7
Enterprise Linux
7
Node.js
7
Graalvm
7
Node Js
7
Swiftnio
7
Traffic Server
7
Bc500 Firmware
7
Jboss Core Services
7
Openshift Service Mesh
7
Jboss Enterprise Application Platform
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-40541 | Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | CRITICAL | 9.0 | 0.5% | 45 |
|
| CVE-2026-4793 | Incorrect default permissions in Synology Assistant before version 7.0.7-50095 expose locally created installation artifacts to unauthorized access, enabling low-privileged local users to read or write arbitrary files and trigger denial-of-service conditions during the installation window. The CVSS score of 7.3 (High) with C:H/I:H/A:H reflects the breadth of potential file system impact, though an EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no public exploitation activity at time of analysis. A vendor-released patch exists at version 7.0.7-50095, and no public exploit code has been identified. | HIGH | 7.3 | 0.1% | 37 |
|
| CVE-2026-9548 | Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-9491 | Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application. | MEDIUM | 4.3 | 0.4% | 22 |
|