Synology Security Advisories & CVEs

1 advisories tracked · Synology PSIRT (security@synology.com CNA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence

Android app · Google Play

Monitor Synology CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts See app features

Check if your Synology device is affected

Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Synology's recent advisories.

Official source

Synology PSIRT (security@synology.com CNA) via NVD

Synology is its own CVE Numbering Authority. VulniPulse ingests Synology's CVEs from the NVD CNA feed (security@synology.com), grouped by their official Synology_SA_YY_NN advisory, then enriches each from the advisory page — a fully server-rendered page carrying Synology's own severity rating, the affected-product / fixed-release table and the mitigation section. Covers DSM (DiskStation Manager), SRM (Router Manager), BeeStation, Synology Photos, Surveillance Station, Synology Drive and the SSL VPN Client.

Visit Synology security advisories Synology RSS feed Synology end-of-life dates(4 product families)

Latest Synology advisories

All severities critical high medium low

All platforms DSM (DiskStation Manager)SRM (Router Manager)Applications BeeStation SSL VPN Client

Critical9.8Synology

Critical [CVE-2025-12686] Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors. Affected products named by the advisory: BeeStation OS 1.3; BeeStation OS 1.2; BeeStation OS 1.1; BeeStation OS 1.0.