CVE Program partner

qnap

QNAP Systems, Inc.

API
CVEs, 365 days182650 all time, 1 rejected
Quality99%median 99%
CVSS by the CNA99%share of records
CWE98%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationQNAP Systems, Inc.
RoleCNA
TypeVendor
Reports tomitre
ScopeQNAP issues only.
Advisorieshttps://www.qnap.com/en/security-advisories

Latest CVEs · RSS

  • CVE-2026-50619 2026-10-15 · CVSS 9.3
    A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpect
  • CVE-2026-47790 2026-10-15 · CVSS 6.3
    A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulne
  • CVE-2026-47786 2026-10-15 · CVSS 9.3
    An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute ar
  • CVE-2026-39997 2026-10-15 · CVSS 8.9
    A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote
  • CVE-2026-39991 2026-10-15 · CVSS 4.8
    A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vul
  • CVE-2026-34009 2026-10-15 · CVSS 8.4
    An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, the
  • CVE-2026-34008 2026-10-15 · CVSS 8.5
    An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, th
  • CVE-2026-34007 2026-10-15 · CVSS 6.9
    An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbit
  • CVE-2026-53882 2026-10-15 · CVSS 8.7
    An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a
  • CVE-2026-50612 2026-10-15 · CVSS 9.4
    An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit th
  • CVE-2026-44084 2026-10-15 · CVSS 8.7
    An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote
  • CVE-2026-41545 2026-10-15 · CVSS 8.6
    A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vuln
  • CVE-2026-41541 2026-10-15 · CVSS 5.3
    An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then expl
  • CVE-2026-39989 2026-10-15 · CVSS 5.3
    A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploi
  • CVE-2026-34015 2026-10-15 · CVSS 8.7
    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to
  • CVE-2026-34014 2026-10-15 · CVSS 8.4
    An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator
  • CVE-2026-34006 2026-10-15 · CVSS 9.3
    A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote at
  • CVE-2026-26245 2026-10-15 · CVSS 7.1
    A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to e
  • CVE-2026-26244 2026-10-15 · CVSS 7.1
    A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to e
  • CVE-2026-26243 2026-10-15 · CVSS 7.2
    A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to
  • CVE-2026-41544 2026-10-15 · CVSS 8.7
    A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read
  • CVE-2026-39993 2026-10-15 · CVSS 8.7
    A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulne
  • CVE-2026-24723 2026-10-15 · CVSS 5.3
    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulner
  • CVE-2026-24722 2026-10-15 · CVSS 5.3
    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulner
  • CVE-2026-24721 2026-10-15 · CVSS 5.3
    A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulner

All CVE Program partners