Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 107

Export CSV
CVE-2025-66272

Arbitrary file deletion and remote code execution

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Video Station Video Station
CVE-2025-29896

NULL Pointer Dereference in qsyncsrv.cgi

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Qsync Central
CVE-2025-68404

vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface

A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Qurouter
CVE-2025-29895

NULL Pointer Dereference in qsyncsrv.cgi

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Qsync Central
CVE-2025-66275

Remote code execution via command injection

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Video Station Video Station
CVE-2025-68403

Inadequate Steps to Confirm Vulnerability in QuRouter

An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Qurouter
CVE-2025-62850

NULL Pointer Dereference in networkRequest.cgi

A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.9.3410 build 20260214 and later QVP 2.7.4 and later QuTS cloud c5.2.9.3468 build 20260413 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Quts Hero Quts Hero
CVE-2026-24717

QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2026-24719

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2026-22897

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later

CVSS 4.0 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2026-26237

QuMagie

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qumagie Qumagie
CVE-2026-26236

QuMagie

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qumagie Qumagie
CVE-2025-62851

License Center

A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: License Center 1.9.56 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
License Center License Center
CVE-2026-24720

File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2026-22899

File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2026-24724

File Station 5

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2026-26241

File Station 5

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2026-26239

File Station 5

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2026-26240

File Station 5

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2025-66273

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later

CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more