Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 656

Export CSV
CVE-2025-62844

QuRouter

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

CVSS 4.0 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qurouter
CVE-2025-62843

QuRouter

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later

CVSS 4.0 · 0.9 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qurouter Qrouter
CVE-2025-59383

Media Streaming Add-on

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Media Streaming Add-on Media Streaming Add-on
CVE-2026-22902

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2026-22901

QuNetSwitch

A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 6.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2026-22900

QuNetSwitch

A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qunetswitch Qunetswitch
CVE-2025-59388

Hyper Data Protector

A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Hyper Data Protector Hyper Data Protector
CVE-2024-14024

Video Station

An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later

CVSS 4.0 · 0.1 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Video Station Video Station
CVE-2024-14025

Video Station

An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later

CVSS 4.0 · 0.1 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Video Station Video Station
CVE-2024-14026

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2025-62847

QTS, QuTS hero

An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to alter execution logic. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2025-59386

QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Quts Hero Quts Hero
CVE-2025-47205

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qts Quts Hero Qts and 1 more
CVE-2025-22481

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero
CVE-2025-47212

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

CVSS 4.0 · 5.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero
CVE-2025-57714

NetBak Replicator

An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: NetBak Replicator 4.5.15.0807 and later

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Netbak Replicator
CVE-2025-30264

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 7.7 High EPSS 1.7% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero
CVE-2025-52856

VioStor

An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qvr
CVE-2025-59385

QTS, QuTS hero

An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without proper authentication. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

CVSS 4.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2023-47565

Legacy VioStor NVR

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QVR Firmware 5.0.0 and later

CVSS 3.1 · 8 High EPSS 73.3% KEV · Listed
Vendors
Qnap
Products
Qvr Firmware