Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Synology bug bounty programs

synology.com Updated

Synology runs one public program: a self-hosted bug bounty paying up to $30,000.

Top reward
$30,000
Self-hosted
Programs
1
1 pays cash
Targets in scope
36
7 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Synology runs.

  • Synology

    Self-hosted · Bug bounty

    Open

    Top reward

    $30k
    Safe harbor
    None
    First response
    7 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

36 targets. 3 excluded.

  • *.account.synology.com

    Wildcards

  • *.c2.synology.com

    Wildcards

  • *.c2.synology.com-domains

    Wildcards

  • *.identity.synology.com

    Wildcards

  • *.identity.synology.com-domains

    Wildcards

  • *.konto.synology.de-domänen

    Wildcards

  • *.synology.com

    Wildcards

  • *.synology.com-domains

    Wildcards

  • c2.synology.com

    Domains

  • identity.synology.com

    Domains

  • konto.synology.de

    Domains

  • synology.com

    Domains

  • Mobile apps

    Android

  • Von Synology entwickelte mobile Anwendungen für Android und iOS

    Android

  • Synology-developed mobile apps for Android and iOS

    iOS

  • BeeStation OS 1.0 (latest version)

    Desktop and binaries

  • DiskStation Manager (DSM)

    Desktop and binaries

  • DSM 7 (latest version)

    Desktop and binaries

  • Firmware 1.1 (latest version)

    Desktop and binaries

  • Operating systems

    Desktop and binaries

  • Packages

    Desktop and binaries

  • SRM 1.3 (latest version)

    Desktop and binaries

  • Synology Camera firmware

    Desktop and binaries

  • Synology-developed software packages

    Desktop and binaries

  • Synology Kamera Firmware Firmware 1.1 (aktuellste Version)

    Hardware and IoT

No target matches. Try part of a host name, such as the company name.

Out of scope 3

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • ask.synology.com

  • openstack-ci-logs.synology.com

  • router.synology.com

Recent changes

Reward and scope changes across every Synology program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Synology products, from the NVD.

Search NVD
  • CVE-2026-4793 High

    An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation.

  • CVE-2022-49042 High

    An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.

  • CVE-2023-52951 Medium

    A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.

  • CVE-2024-47263 Medium

    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.

  • CVE-2024-47273 Medium

    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.

  • CVE-2022-49036 High

    An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.

  • CVE-2025-66592 Medium

    An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.

  • CVE-2025-66593 Medium

    An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.

About this page

This page gathers every public program listed under synology.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.