[ Vendor · 43 CVEs ]
QNAP Systems Inc.
CVEs affecting QNAP Systems Inc. published in the last 30 days, plus any QNAP Systems Inc. CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-50612 | 15 Oct 2026 | CVSS 9.4 | QNAP Systems Inc. QuMagieAn unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then… | |
| CVE-2026-50619 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. QsirchA path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents… | |
| CVE-2026-53882 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. Virtualization StationAn improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote… | |
| CVE-2026-39991 | 15 Oct 2026 | CVSS 4.8 | QNAP Systems Inc. Notes Station 3A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then… | |
| CVE-2026-39997 | 15 Oct 2026 | CVSS 8.9 | QNAP Systems Inc. HybridDesk StationA missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could… | |
| CVE-2026-41541 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Qsync CentralAn unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they… | |
| CVE-2026-41545 | 15 Oct 2026 | CVSS 8.6 | QNAP Systems Inc. QuMagieA relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then… | |
| CVE-2026-44084 | 15 Oct 2026 | CVSS 7.5 | QNAP Systems Inc. Video StationAn authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could… | |
| CVE-2026-47786 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. HybridDesk StationAn OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-47790 | 15 Oct 2026 | CVSS 6.3 | QNAP Systems Inc. QuFTP ServiceA cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then… | |
| CVE-2026-26245 | 15 Oct 2026 | CVSS 8.8 | QNAP Systems Inc. Video StationA SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-34006 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. sMedio DTCP MOVEA missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could… | |
| CVE-2026-34007 | 15 Oct 2026 | CVSS 6.9 | QNAP Systems Inc. Notes Station 3An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-34008 | 15 Oct 2026 | CVSS 8.5 | QNAP Systems Inc. Notes Station 3An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user… | |
| CVE-2026-34009 | 15 Oct 2026 | CVSS 8.4 | QNAP Systems Inc. Notes Station 3An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator… | |
| CVE-2026-34014 | 15 Oct 2026 | CVSS 8.4 | QNAP Systems Inc. Download StationAn incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an… | |
| CVE-2026-34015 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. Video StationA path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-39989 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Download StationA server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can… | |
| CVE-2026-26243 | 15 Oct 2026 | CVSS 7.2 | QNAP Systems Inc. Qsync CentralA path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-26244 | 15 Oct 2026 | CVSS 8.8 | QNAP Systems Inc. Video StationA SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-24723 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2026-39993 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. Download StationA relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then… | |
| CVE-2026-41544 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. QcalAgentA path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-22896 | 15 Oct 2026 | CVSS 6.2 | QNAP Systems Inc. Network & Virtual SwitchA cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account… | |
| CVE-2026-24715 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. QuRouterAn observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-24718 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Qsync CentralA path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-24721 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2026-24722 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2025-68403 | 15 Oct 2026 | CVSS 4.6 | QNAP Systems Inc. QuRouterAn external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator… | |
| CVE-2025-68404 | 15 Oct 2026 | CVSS 7.5 | QNAP Systems Inc. QuRouterA time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow… | |
| CVE-2025-29897 | 15 Oct 2026 | CVSS 2.3 | QNAP Systems Inc. Qsync CentralA buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they… | |
| CVE-2025-66272 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. Video StationA path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2025-66275 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. Video StationA path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2025-29895 | 15 Oct 2026 | CVSS 2.3 | QNAP Systems Inc. Qsync CentralA NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2025-29896 | 15 Oct 2026 | CVSS 2.3 | QNAP Systems Inc. Qsync CentralA NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2023-47565 | 8 Dec 2023 | CVSS 8.8 | QNAP VioStor NVR OS Command InjectionAn OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the… | Exploited |
| CVE-2022-27593 | 8 Sep 2022 | CVSS 9.1 | QNAP Photo Station Externally Controlled ReferenceAn externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could… | Exploited |
| CVE-2021-28799 | 13 May 2021 | CVSS 9.8 | QNAP NAS Improper AuthorizationAn improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability… | Exploited |
| CVE-2020-2509 | 17 Apr 2021 | CVSS 9.8 | QNAP Network-Attached Storage (NAS) Command InjectionA command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute… | Exploited |
| CVE-2020-2506 | 3 Feb 2021 | CVSS 9.8 | QNAP Helpdesk Improper Access ControlThe vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow… | Exploited |
| CVE-2018-19943 | 28 Oct 2020 | CVSS 5.4 | QNAP NAS File Station Cross-Site ScriptingIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in… | Exploited |
| CVE-2018-19949 | 28 Oct 2020 | CVSS 9.8 | QNAP NAS File Station Command InjectionIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the… | Exploited |
| CVE-2018-19953 | 28 Oct 2020 | CVSS 6.1 | QNAP NAS File Station Cross-Site ScriptingIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the… | Exploited |