QNAP Systems Inc.
592 CVEs in 69 QNAP Systems Inc. products, including Qts, Quts Hero, Qsync Central. Newest: CVE-2026-53882 (2026-10-15).
QNAP Systems Inc. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53882 | | 2026-10-15 | An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains… | |
CVE-2026-50619 | | 2026-10-15 | A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpec… | |
CVE-2026-50612 | | 2026-10-15 | An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit t… | |
CVE-2026-47790 | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vuln… | |
CVE-2026-47786 | | 2026-10-15 | An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute a… | |
CVE-2026-44084 | High | 7.5 | 2026-10-15 | An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote… |
CVE-2026-41545 | | 2026-10-15 | A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vul… | |
CVE-2026-41541 | | 2026-10-15 | An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exp… | |
CVE-2026-39997 | | 2026-10-15 | A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote… | |
CVE-2026-39991 | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vu… | |
CVE-2026-39989 | | 2026-10-15 | A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then explo… | |
CVE-2026-34015 | Medium | 6.5 | 2026-10-15 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2026-34014 | | 2026-10-15 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator… | |
CVE-2026-34009 | | 2026-10-15 | An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, th… | |
CVE-2026-34008 | | 2026-10-15 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, t… | |
CVE-2026-34007 | | 2026-10-15 | An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbi… | |
CVE-2026-34006 | | 2026-10-15 | A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote a… | |
CVE-2026-26245 | High | 8.8 | 2026-10-15 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2026-26244 | High | 8.8 | 2026-10-15 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2026-26243 | | 2026-10-15 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… | |
CVE-2026-41544 | | 2026-10-15 | A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to rea… | |
CVE-2026-39993 | | 2026-10-15 | A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vuln… | |
CVE-2026-24723 | Medium | 6.5 | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2026-24722 | Medium | 6.5 | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2026-24721 | Medium | 6.5 | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2026-24718 | | 2026-10-15 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… | |
CVE-2026-24715 | | 2026-10-15 | An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sen… | |
CVE-2026-22896 | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can… | |
CVE-2025-68404 | | 2026-10-15 | A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote atta… | |
CVE-2025-68403 | | 2026-10-15 | An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account… | |
CVE-2025-66275 | Medium | 6.5 | 2026-10-15 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-66272 | Medium | 6.5 | 2026-10-15 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-29897 | | 2026-10-15 | A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then… | |
CVE-2025-29896 | | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… | |
CVE-2025-29895 | | 2026-10-15 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… | |
CVE-2024-27123 | | 2026-09-18 | A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mec… | |
CVE-2026-26241 | Critical | 9.1 | 2026-06-10 | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash p… |
CVE-2026-26240 | Critical | 9.1 | 2026-06-10 | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash p… |
CVE-2026-26239 | High | 8.1 | 2026-06-10 | A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability… |
CVE-2026-26237 | High | 7.5 | 2026-06-10 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-24724 | High | 8.1 | 2026-06-10 | An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2026-24720 | Medium | 6.5 | 2026-06-10 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, th… |
CVE-2026-24719 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2026-24717 | Medium | 6.5 | 2026-06-10 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2026-24716 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2026-22899 | Medium | 6.5 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2026-22893 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-66281 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-66280 | High | 7.2 | 2026-06-10 | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator… |
CVE-2025-66279 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-66273 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-62851 | Medium | 4.4 | 2026-06-10 | A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62850 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, t… |
CVE-2025-66276 | Critical | 9.8 | 2026-06-10 | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later |
CVE-2025-59382 | | 2026-06-10 | QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version: | |
CVE-2025-58468 | High | 8.8 | 2026-06-10 | A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to g… |
CVE-2026-44083 | Critical | 9.8 | 2026-06-09 | An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability… |
CVE-2025-62858 | Medium | 6.5 | 2026-06-09 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2026-41539 | Medium | 6.1 | 2026-06-09 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulner… |
CVE-2026-26236 | High | 7.5 | 2026-06-09 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-22902 | Medium | 6.7 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2026-22901 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2026-22900 | Critical | 9.8 | 2026-03-20 | A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthor… |
CVE-2026-22898 | Critical | 9.8 | 2026-03-20 | A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to ga… |
CVE-2026-22897 | Critical | 9.8 | 2026-03-20 | A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary command… |
CVE-2026-22895 | Medium | 4.8 | 2026-03-20 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploi… |
CVE-2025-62846 | Medium | 6.7 | 2026-03-20 | An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability t… |
CVE-2025-62845 | Medium | 6.7 | 2026-03-20 | An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator ac… |
CVE-2025-62844 | Medium | 5.5 | 2026-03-20 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to ga… |
CVE-2025-62843 | Medium | 6.8 | 2026-03-20 | An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, t… |
CVE-2025-59383 | Critical | 9.1 | 2026-03-20 | A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or… |
CVE-2025-59388 | Critical | 9.8 | 2026-03-12 | A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain un… |
CVE-2024-14026 | High | 7.8 | 2026-03-11 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also g… |
CVE-2024-14025 | Medium | 6.7 | 2026-03-11 | An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator accou… |
CVE-2024-14024 | Medium | 6.7 | 2026-03-11 | An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an a… |
CVE-2026-22894 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-68406 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-66278 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-66277 | Critical | 9.8 | 2026-02-11 | A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to t… |
CVE-2025-66274 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-62856 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62855 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62854 | Medium | 6.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-62853 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-59386 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-58472 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-58471 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-58470 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-58467 | Medium | 6.5 | 2026-02-11 | A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnera… |
CVE-2025-58466 | Medium | 4.9 | 2026-02-11 | A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator a… |
CVE-2025-57713 | High | 7.5 | 2026-02-11 | A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive infor… |
CVE-2025-57711 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57710 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57709 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-57708 | Medium | 6.5 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-57707 | High | 8.8 | 2026-02-11 | An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remo… |
CVE-2025-54170 | Medium | 6.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabili… |
CVE-2025-54169 | Medium | 6.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-54163 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-54162 | Medium | 4.9 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulne… |