CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,470 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,470
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product asustor:data_master. Show all products

19 CVEs, showing 1 to 19
CVESeverityTitlePublished
CVE-2025-13052Medium 5.9When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SM…Dec 12, 2025
CVE-2025-13053Low 3.7When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic between the client and se…Dec 12, 2025
CVE-2026-24932Medium 5.9The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate.Feb 3, 2026
CVE-2026-24933Medium 5.9The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server.Feb 3, 2026
CVE-2026-24934Low 3.7The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address.Feb 3, 2026
CVE-2026-24935Medium 5.6A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server.Feb 3, 2026
CVE-2026-24936Critical 9.8When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to…Feb 3, 2026
CVE-2026-3100Medium 6.5The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS.Feb 25, 2026
CVE-2026-3179High 8.1The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings.Feb 25, 2026
CVE-2026-6643Critical 9.9A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM.Apr 20, 2026
CVE-2026-6644Critical 9.1A command injection vulnerability was found in the PPTP VPN Clients on the ADM.Apr 20, 2026
CVE-2026-18186High 8.1A stored format string vulnerability was found in the FTP Backup on the ADM.Jul 30, 2026
CVE-2026-18187High 8.1A format string vulnerability was found in the Internal Backup on the ADM.Jul 30, 2026
CVE-2026-18188High 8.1A format string vulnerability was found in the Rsync Backup on the ADM.Jul 30, 2026
CVE-2026-67244High 7.2A format string vulnerability was found in the Notification OAuth settings of ADM.Jul 30, 2026
CVE-2026-67245High 8.1A path traversal vulnerability was found in the VPN Clients on the ADM.Jul 30, 2026
CVE-2026-67246Medium 6.5A path traversal vulnerability was found in the Wallpaper component of ADM.Jul 30, 2026
CVE-2026-67247Medium 6.5A path traversal vulnerability was found in the IHM Log handling of ADM.Jul 30, 2026
CVE-2026-67248High 8.8A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM.Jul 30, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.