Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-34014

ds-move-files.sh is writable and executed as root

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Download Station
CVE-2026-39989

SSRF in QNAP Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Systems
Products
Download Station