Download Station (Qnap Systems Inc.) - vulnerabilities (CVEs)

6 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-15. Vendor: Qnap Systems Inc..

CVEs of Download Station

• CVE-2026-39989 - CVSS 5.3 (medium), 2026-10-15: A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then…
• CVE-2026-34014 - CVSS 8.4 (high), 2026-10-15: An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an…
• CVE-2026-39993 - CVSS 8.7 (high), 2026-10-15: A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the…
• CVE-2025-58465 - CVSS 5.4 (medium), 2025-11-07: A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the…
• CVE-2025-58463 - CVSS 4.9 (medium), 2025-11-07: A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then…
• CVE-2024-38640 - CVSS 7 (high), 2024-09-06: A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to…