Skip to contentQnap Systems Inc. vulnerabilities
Products
Show 5 moreShow less
Newest
- qnap systems inc. hbs 3 hybrid backup sync, hybrid backup sync +1 moreHard-coded Cryptographic Key #2CVE-2025-628418.7 High
- qnap systems inc. hbs 3 hybrid backup sync, hybrid backup sync +1 moreHard-coded Cryptographic Key #1CVE-2025-628398.7 High
- qnap systems inc. qsirchUnauthenticated remote code execution vulnerabilityCVE-2026-506199.3 Critical
- qnap systems inc. quftp servicePrivilege Escalation via QuFTP Log-based XSSCVE-2026-477906.3 Medium
- qnap systems inc. hybriddesk stationPre-Authentication Command InjectionCVE-2026-477869.3 Critical
- qnap systems inc. hybriddesk stationUnauthenticated Remote Input Injection in QNAP HD Station's remotepadCVE-2026-399978.9 High
- qnap systems inc. notes station 3Stored Cross-Site Scripting (XSS) in Note Station file upload functionalityCVE-2026-399914.8 Medium
- qnap systems inc. notes station 3**Container Escape** Host user home directory mounted with write access into application containerCVE-2026-340098.4 High
- qnap systems inc. notes station 3**Privilege Escalation** World-writable crontab path monitored and executed by root-owned processCVE-2026-340088.5 High
- qnap systems inc. notes station 3**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`CVE-2026-340076.9 Medium
- qnap systems inc. virtualization stationPath Traversal in Virtualization Station VM ImportCVE-2026-538828.7 High
- qnap systems inc. qumagieImport Symlink Following Remote Code Execution Vulnerability in QuMagieCVE-2026-506129.4 Critical
- qnap video stationAccess Code Forgery in Video Station leading to unauthorized media accessCVE-2026-440848.7 High
- qnap systems inc. qumagieWebSocket timelapse path traversal and command injectionCVE-2026-415458.6 High
- qnap systems inc. qsync centralSymlink creation in qsyncsrv.cgiCVE-2026-415415.3 Medium
- qnap systems inc. download stationSSRF in QNAP Download StationCVE-2026-399895.3 Medium
- qnap video stationRemote Code Execution in upload.php of Video StationCVE-2026-340158.7 High
- qnap systems inc. download stationds-move-files.sh is writable and executed as rootCVE-2026-340148.4 High
- qnap systems inc. smedio dtcp movePre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServerCVE-2026-340069.3 Critical
- qnap video stationSQLi#2 SQL Injection in class_videos.php getSmartVideosByOffsetCVE-2026-262457.1 High
- qnap video stationSQLi#1 SQL Injection in class_videos.php _getFiltersCVE-2026-262447.1 High
- qnap systems inc. qsync centralArbitrary Folder Deletion in Qsync Central 5.0.0.5CVE-2026-262437.2 High
- qnap systems inc. qcalagentPath Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpointCVE-2026-415448.7 High
- qnap systems inc. download stationPath Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterCVE-2026-399938.7 High
- qnap file station, qnap systems inc. file station 5 +1 moreNULL Pointer Dereference in utilRequest.cgiCVE-2026-247235.3 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreNull Pointer Dereference in File Station 5CVE-2026-247225.3 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreNull Pointer Dereference in File Station 5CVE-2026-247215.3 Medium
- qnap systems inc. qsync centralPath Traversal Vulnerability in Qsync Central's qsyncsrv.cgiCVE-2026-247185.3 Medium
- qnap systems inc. qurouterLack of Reproducible Vulnerability Evidence in QNAP ReportCVE-2026-247155.3 Medium
- qnap systems inc. network & virtual switchStored XSS via Interface Name in Network & Virtual Switch AppCVE-2026-228966.2 Medium
- qnap systems inc. quroutervcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interfaceCVE-2025-684047.5 High
- qnap systems inc. qurouterInadequate Steps to Confirm Vulnerability in QuRouterCVE-2025-684034.6 Medium
- qnap video stationRemote code execution via command injectionCVE-2025-662757.7 High
- qnap video stationArbitrary file deletion and remote code executionCVE-2025-662727.7 High
- qnap systems inc. qsync centralStack-based Buffer Overflow in qsyncsrv.cgiCVE-2025-298972.3 Low
- qnap systems inc. qsync centralNULL Pointer Dereference in qsyncsrv.cgiCVE-2025-298962.3 Low
- qnap systems inc. qsync centralNULL Pointer Dereference in qsyncsrv.cgiCVE-2025-298952.3 Low
- qnap systems inc. qtsQTSCVE-2024-386394.8 Medium
- qnap systems inc. qcalagentQcalAgentCVE-2024-271235.2 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-262401.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-262411.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-247246.2 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-262396.3 Medium
- qnap qumagieQuMagieCVE-2026-262376.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS heroCVE-2026-247196.1 Medium
- qnap qts, quts hero +1 moreQTS, QuTS heroCVE-2026-247171.2 Low
- qnap qts, quts hero +1 moreQTS, QuTS heroCVE-2026-247161.2 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-247201.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 5CVE-2026-228991.3 Low
- qnap qts, quts hero +1 moreQTS, QuTS heroCVE-2026-228938.6 High
- Show olderLoading…