CVEs published by QNAP Systems, Inc.

CVEs published by QNAP Systems, Inc. (CVE Numbering Authority). 37 tracked.

• CVE-2025-66272 MEDIUM 6.5 UPGRADE A path traversal vulnerability has been reported to affect Video Station
• CVE-2025-66275 MEDIUM 6.5 UPGRADE A path traversal vulnerability has been reported to affect Video Station
• CVE-2025-68404 HIGH 7.5 A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter
• CVE-2025-68403 MEDIUM 4.6 An external control of system or configuration setting vulnerability has been reported to affect QuRouter
• CVE-2025-29895 LOW 2.3 A NULL pointer dereference vulnerability has been reported to affect Qsync Central
• CVE-2025-29896 LOW 2.3 A NULL pointer dereference vulnerability has been reported to affect Qsync Central
• CVE-2025-29897 LOW 2.3 A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central
• CVE-2026-24721 MEDIUM 6.5 UPGRADE A NULL pointer dereference vulnerability has been reported to affect File Station 5
• CVE-2026-24722 MEDIUM 6.5 UPGRADE A NULL pointer dereference vulnerability has been reported to affect File Station 5
• CVE-2026-24723 MEDIUM 6.5 UPGRADE A NULL pointer dereference vulnerability has been reported to affect File Station 5
• CVE-2026-26244 HIGH 8.8 UPGRADE A SQL injection vulnerability has been reported to affect Video Station
• CVE-2026-26245 HIGH 8.8 UPGRADE A SQL injection vulnerability has been reported to affect Video Station
• CVE-2026-34015 MEDIUM 6.5 UPGRADE A path traversal vulnerability has been reported to affect Video Station
• CVE-2026-44084 HIGH 7.5 UPGRADE An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station
• CVE-2026-24715 MEDIUM 5.3 An observable timing discrepancy vulnerability has been reported to affect QuRouter
• CVE-2026-22896 MEDIUM 6.2 A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch
• CVE-2026-47786 CRITICAL 9.3 An OS command injection vulnerability has been reported to affect HybridDesk Station
• CVE-2026-34007 MEDIUM 6.9 An OS command injection vulnerability has been reported to affect Notes Station 3
• CVE-2026-50619 CRITICAL 9.3 A path traversal vulnerability has been reported to affect Qsirch
• CVE-2026-34006 CRITICAL 9.3 A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE
• CVE-2026-50612 CRITICAL 9.4 An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie
• CVE-2026-41545 HIGH 8.6 A relative path traversal vulnerability has been reported to affect QuMagie
• CVE-2026-39993 HIGH 8.7 A relative path traversal vulnerability has been reported to affect Download Station
• CVE-2026-41544 HIGH 8.7 A path traversal vulnerability has been reported to affect QcalAgent
• CVE-2026-53882 HIGH 8.7 An improper link resolution before file access ('link following') vulnerability has been reported to affect Vi
• CVE-2026-39997 HIGH 8.9 A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station
• CVE-2026-26243 HIGH 7.2 A path traversal vulnerability has been reported to affect Qsync Central
• CVE-2026-34008 HIGH 8.5 An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Stati
• CVE-2026-34009 HIGH 8.4 An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3
• CVE-2026-34014 HIGH 8.4 An incorrect permission assignment for critical resource vulnerability has been reported to affect Download St
• CVE-2026-47790 MEDIUM 6.3 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service
• CVE-2026-24718 MEDIUM 5.3 A path traversal vulnerability has been reported to affect Qsync Central
• CVE-2026-41541 MEDIUM 5.3 An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central
• CVE-2026-39989 MEDIUM 5.3 A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station
• CVE-2026-39991 MEDIUM 4.8 A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3
• CVE-2024-38639 MEDIUM 4.8 An improper authentication vulnerability has been reported to affect product
• CVE-2024-27123 MEDIUM 5.2 A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent

← Back to latest CVEs