Qnap Qts
320 CVEs affecting Qnap Qts. Latest disclosed: 2026-06-10. Critical: 53, High: 84.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32766 | Critical | 10.0 | 2024-04-26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2022-27593 | Critical | 10.0 | 2022-09-08 | An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an at… |
CVE-2021-28799 | Critical | 10.0 | 2021-05-13 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote… |
CVE-2017-7876 | Critical | 10.0 | 2017-06-15 | This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS… |
CVE-2025-66276 | Critical | 9.8 | 2026-06-10 | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later |
CVE-2025-66277 | Critical | 9.8 | 2026-02-11 | A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to t… |
CVE-2025-62849 | Critical | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to e… |
CVE-2025-59385 | Critical | 9.8 | 2025-12-16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit th… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-21899 | Critical | 9.8 | 2024-03-08 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users… |
CVE-2023-23368 | Critical | 9.8 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2022-27596 | Critical | 9.8 | 2023-01-30 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious co… |
CVE-2021-34344 | Critical | 9.8 | 2021-09-10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute ar… |
CVE-2021-28809 | Critical | 9.8 | 2021-07-08 | An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to com… |
CVE-2021-28804 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2021-28802 | Critical | 9.8 | 2021-07-01 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary comm… |
CVE-2020-36195 | Critical | 9.8 | 2021-04-17 | An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability a… |
CVE-2020-2509 | Critical | 9.8 | 2021-04-17 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2019-7198 | Critical | 9.8 | 2020-12-10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2018-19950 | Critical | 9.8 | 2020-11-02 | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Stat… |