Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 656

Export CSV
CVE-2022-27600

QTS, QuTS hero, QuTScloud

An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2277 and later QTS 4.5.4.2280 build 20230112 and later QuTS hero h5.0.1.2277 build 20230112 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2024-50395

Media Streaming add-on

An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later

CVSS 4.0 · 6.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Qnap
Products
Media Streaming Add-on
CVE-2024-50387

SMB Service

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service h4.15.002 and later

CVSS 4.0 · 10 Critical EPSS 10.0% KEV · Not listed
Vendors
Qnap
Products
Smb Service
CVE-2024-48863

License Center

A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: License Center 1.9.43 and later

CVSS 4.0 · 7.7 High EPSS 1.1% KEV · Not listed
Vendors
Qnap
Products
License Center
CVE-2025-44015

HybridDesk Station

A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.18 and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Hybriddesk Station
CVE-2024-53696

QuLog Center

A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.829 ( 2024/10/01 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later QTS 4.5.4.2957 build 20241119 and later QuTS hero h4.5.4.2956 build 20241119 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Qulog Center Quts Hero
CVE-2023-32969

Network & Virtual Switch

A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2024-21905

QTS, QuTS hero, QuTScloud

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2024-27124

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2023-47222

Media Streaming add-on

An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5 ( 2024/01/22 ) and later

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Media Streaming Add-on
CVE-2024-50406

License Center

A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: License Center 1.9.49 and later

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
License Center
CVE-2025-22483

License Center

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: License Center 1.8.51 and later License Center 1.9.51 and later

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
License Center
CVE-2025-58463

Download Station

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Download Station Qts Quts Hero
CVE-2025-58465

Download Station

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later

CVSS 4.0 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Download Station Qts Quts Hero
CVE-2025-54168

QuLog Center

A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.923 ( 2025/08/27 ) and later

CVSS 4.0 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qulog Center
CVE-2025-52425

QuMagie

An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QuMagie 2.7.0 and later

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qumagie
CVE-2025-58464

QuMagie

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.7.3 and later

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qumagie
CVE-2025-57712

Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.3 ( 2025/08/28 ) and later

CVSS 4.0 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qsync Central
CVE-2025-57706

File Station 5

A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later

CVSS 4.0 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
File Station
CVE-2025-53413

File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
File Station