Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 656

Export CSV
CVE-2025-54164

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2025-54165

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2025-54166

QTS, QuTS hero

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2025-47208

QTS, QuTS hero

An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2025-57705

QTS, QuTS hero

An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems Inc.
Products
Qts Quts Hero Qts and 1 more
CVE-2024-21900

QTS, QuTS hero, QuTScloud

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 4.3 Medium EPSS 9.4% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2023-47218

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 5.8 Medium EPSS 89.9% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2023-34980

QTS, QuTS hero

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero
CVE-2023-51364

QTS, QuTS hero, QuTScloud

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 8.7 High EPSS 39.7% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2023-51365

QTS, QuTS hero, QuTScloud

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 8.7 High EPSS 34.8% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2024-32765

QTS, QuTS hero

A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QuTS hero h5.1.8.2823 build 20240712 and later

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero
CVE-2024-50404

Qsync Central

A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: Qsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later

CVSS 4.0 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Qnap
Products
Qsync Central
CVE-2024-32764

myQNAPcloud Link

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud Link 2.4.51 and later

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Myqnapcloud Link
CVE-2024-32766

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 10 Critical EPSS 2.3% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2025-54154

QNAP Authenticator

An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QNAP Authenticator 1.3.1.1227 and later

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Authenticator
CVE-2023-50358

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QTS 4.3.6.2665 build 20240131 and later QTS 4.3.4.2675 build 20240131 and later QTS 4.3.3.2644 build 20240131 and later QTS 4.2.6 build 20240131 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS 3.1 · 5.8 Medium EPSS 13.5% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2023-47220

Media Streaming add-on

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5 ( 2024/01/22 ) and later

CVSS 3.1 · 6.6 Medium EPSS 1.2% KEV · Not listed
Vendors
Qnap
Products
Media Streaming Add-on
CVE-2024-38647

QNAP AI Core

An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QNAP AI Core 3.4.1 and later

CVSS 4.0 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Ai Core
CVE-2024-48862

QuLog Center

A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.831 ( 2024/10/15 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qulog Center
CVE-2022-27595

QVPN Device Client

An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QVPN Windows 2.0.0.1316 and later QVPN Windows 2.0.0.1310 and later

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qvpn