QNAP Systems Inc.
Page 2 of 6 — QNAP Systems Inc. CVEs from a corpus of 556, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48721 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-11837 | Critical | 9.8 | 2026-01-02 | An improper control of generation of code vulnerability has been reported to affect Malware Remover. The remote attackers can then exploit the vulnerability to… |
CVE-2025-62857 | Medium | 6.1 | 2026-01-02 | A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mech… |
CVE-2025-57705 | Medium | 4.9 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-54166 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54165 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-54164 | Medium | 4.9 | 2026-01-02 | An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, th… |
CVE-2025-53596 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53593 | Medium | 6.5 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-53592 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-53591 | Medium | 6.5 | 2026-01-02 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53590 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53589 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53414 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-53405 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52872 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52864 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52863 | High | 8.1 | 2026-01-02 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-52431 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52430 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52426 | Medium | 4.9 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47208 | Medium | 6.5 | 2026-01-02 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker… |
CVE-2025-44013 | Medium | 6.5 | 2026-01-02 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-62849 | Critical | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to e… |
CVE-2025-62848 | High | 7.5 | 2025-12-16 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-62847 | High | 7.5 | 2025-12-16 | An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote att… |
CVE-2025-59385 | Critical | 9.8 | 2025-12-16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit th… |
CVE-2017-20210 | Critical | 9.8 | 2025-11-11 | Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research. |
CVE-2025-58469 | High | 8.8 | 2025-11-07 | A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain pri… |
CVE-2025-58465 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the v… |
CVE-2025-58464 | High | 7.5 | 2025-11-07 | A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability to read the contents… |
CVE-2025-58463 | Medium | 4.9 | 2025-11-07 | A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploi… |
CVE-2025-57712 | Medium | 6.5 | 2025-11-07 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-57706 | Medium | 5.4 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vul… |
CVE-2025-54168 | Medium | 4.8 | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-54167 | | 2025-11-07 | A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then… | |
CVE-2025-53413 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53412 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-53411 | Medium | 4.9 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-53410 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53409 | Medium | 6.5 | 2025-11-07 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-53408 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-52865 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-52425 | Critical | 9.8 | 2025-11-07 | An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. … |
CVE-2025-47207 | Medium | 6.5 | 2025-11-07 | A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-57714 | High | 7.8 | 2025-10-03 | An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit… |
CVE-2025-54154 | Medium | 6.8 | 2025-10-03 | An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulner… |
CVE-2025-54153 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53595 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53407 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-53406 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52867 | Medium | 6.5 | 2025-10-03 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-52866 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52862 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52860 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52859 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52858 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52857 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52855 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52854 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52853 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52433 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52432 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52429 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-52428 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52427 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-52424 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48730 | Medium | 6.5 | 2025-10-03 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an ad… |
CVE-2025-48729 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48728 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48727 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-48726 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47214 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47213 | Medium | 4.9 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-47212 | High | 7.2 | 2025-10-03 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-47211 | Medium | 4.9 | 2025-10-03 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-47210 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44014 | High | 8.8 | 2025-10-03 | An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-44012 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44011 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44010 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44009 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44008 | Medium | 6.5 | 2025-10-03 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-44007 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-44006 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33040 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33039 | Medium | 6.5 | 2025-10-03 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-33034 | Medium | 6.5 | 2025-10-03 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2024-56804 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-52861 | | 2025-08-29 | A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerabilit… | |
CVE-2025-52856 | Critical | 9.8 | 2025-08-29 | An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the s… |
CVE-2025-44015 | High | 8.4 | 2025-08-29 | A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerab… |
CVE-2025-33038 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33037 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33036 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33033 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33032 | Medium | 4.9 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-30278 | High | 8.8 | 2025-08-29 | An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit th… |
CVE-2025-30277 | High | 8.8 | 2025-08-29 | An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit th… |
CVE-2025-30275 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |