Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 107

Export CSV
CVE-2025-66280

QTS, QuTS hero

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2026-44083

QuMagie

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qumagie Qumagie
CVE-2025-62858

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3397 build 20260206 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2025-59382

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)

QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Qts Quts Hero Qutscloud
CVE-2025-58468

Notification Center

A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: Notification Center 1.10.0.3291 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Notification Center Notification Center
CVE-2025-66274

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h6.0.0.3397 build 20260206 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Quts Hero Quts Hero
CVE-2026-22895

QuFTP Service

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuFTP Service 1.4.3 and later QuFTP Service 1.5.2 and later QuFTP Service 1.6.2 and later

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Quftp Quftp Service
CVE-2026-22894

File Station 5

A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
File Station File Station 5
CVE-2025-62845

QuRouter

An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qurouter
CVE-2026-22898

QVR Pro

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qvr Pro Qvr Pro
CVE-2025-62846

QuRouter

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qurouter
CVE-2025-62844

QuRouter

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

CVSS 4.0 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qurouter
CVE-2025-62843

QuRouter

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

CVSS 4.0 · 0.9 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qrouter
CVE-2025-59383

Media Streaming Add-on

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Media Streaming Add-on Media Streaming Add-on
CVE-2026-22902

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2026-22901

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 6.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2026-22900

QuNetSwitch

A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2025-59388

Hyper Data Protector

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Hyper Data Protector Hyper Data Protector
CVE-2024-14024

Video Station

An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later

CVSS 4.0 · 0.1 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Video Station Video Station