QNAP Systems Inc.
Page 3 of 6 — QNAP Systems Inc. CVEs from a corpus of 556, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30274 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a… |
CVE-2025-30273 | High | 8.1 | 2025-08-29 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can th… |
CVE-2025-30272 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a… |
CVE-2025-30271 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-30270 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-30268 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-30267 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-30265 | Medium | 6.5 | 2025-08-29 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-30264 | High | 8.8 | 2025-08-29 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then… |
CVE-2025-30263 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-30262 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-30261 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-30260 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-29900 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29899 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29898 | Medium | 6.5 | 2025-08-29 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29894 | High | 8.8 | 2025-08-29 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-29893 | High | 8.8 | 2025-08-29 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-29890 | Medium | 6.5 | 2025-08-29 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, th… |
CVE-2025-29889 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29888 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29887 | High | 7.2 | 2025-08-29 | A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vu… |
CVE-2025-29886 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29882 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they ca… |
CVE-2025-29879 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29878 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29875 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-29874 | Medium | 6.5 | 2025-08-29 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-22483 | Medium | 4.8 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator acco… |
CVE-2024-12923 | Medium | 5.4 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29901 | Medium | 6.5 | 2025-08-26 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulne… |
CVE-2025-47206 | High | 8.1 | 2025-08-18 | An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerabi… |
CVE-2025-33035 | Medium | 6.5 | 2025-06-06 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability… |
CVE-2025-33031 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit t… |
CVE-2025-30279 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29892 | High | 8.8 | 2025-06-06 | An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2025-29885 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29884 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29883 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29877 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29876 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29873 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29872 | High | 7.5 | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… |
CVE-2025-29871 | Medium | 5.5 | 2025-06-06 | An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the… |
CVE-2025-22490 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-22486 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-22484 | | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… | |
CVE-2025-22482 | High | 8.1 | 2025-06-06 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attack… |
CVE-2025-22481 | High | 8.8 | 2025-06-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-56805 | Medium | 5.4 | 2025-06-06 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attacker… |
CVE-2024-50406 | Medium | 5.4 | 2025-06-06 | A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have ga… |
CVE-2024-13088 | High | 7.8 | 2025-06-06 | An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability… |
CVE-2024-13087 | Medium | 6.7 | 2025-06-06 | A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, t… |
CVE-2024-53700 | High | 7.2 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator… |
CVE-2024-53699 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53698 | Medium | 4.9 | 2025-03-07 | A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers wh… |
CVE-2024-53697 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-53696 | Medium | 4.9 | 2025-03-07 | A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2024-53695 | Critical | 9.1 | 2025-03-07 | A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to modify me… |
CVE-2024-53694 | | 2025-03-07 | A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could a… | |
CVE-2024-53693 | High | 7.1 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-53692 | Medium | 4.7 | 2025-03-07 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50405 | Medium | 5.5 | 2025-03-07 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-50394 | High | 8.8 | 2025-03-07 | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromi… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2024-48864 | Critical | 9.1 | 2025-03-07 | A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem… |
CVE-2024-38638 | High | 7.2 | 2025-03-07 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote att… |
CVE-2024-13086 | Medium | 5.3 | 2025-03-07 | An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to comprom… |
CVE-2023-23357 | Medium | 4.8 | 2024-12-19 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remo… |
CVE-2023-23356 | Medium | 5.5 | 2024-12-19 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2023-23354 | High | 7.3 | 2024-12-19 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remo… |
CVE-2022-27600 | Medium | 6.8 | 2024-12-19 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2022-27595 | High | 7.8 | 2024-12-19 | An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have… |
CVE-2024-53691 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-50404 | High | 8.8 | 2024-12-06 | A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2024-50403 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50402 | High | 7.2 | 2024-12-06 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50389 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We… |
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-50387 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-48868 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48867 | High | 7.5 | 2024-12-06 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited… |
CVE-2024-48866 | Medium | 5.3 | 2024-12-06 | An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnera… |
CVE-2024-48865 | High | 7.5 | 2024-12-06 | An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allo… |
CVE-2024-48863 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-50401 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50400 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50399 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50398 | High | 7.2 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50397 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50396 | High | 8.8 | 2024-11-22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability… |
CVE-2024-50395 | High | 8.8 | 2024-11-22 | An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could all… |
CVE-2024-48862 | Critical | 9.8 | 2024-11-22 | A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file syst… |
CVE-2024-48861 | High | 7.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers… |
CVE-2024-48860 | Critical | 9.8 | 2024-11-22 | An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-38647 | High | 7.5 | 2024-11-22 | An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to co… |
CVE-2024-38646 | Medium | 6.0 | 2024-11-22 | An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow… |
CVE-2024-38645 | Medium | 6.5 | 2024-11-22 | A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticate… |