Qnap Systems Inc. - vulnerabilities (CVEs)

593 CVEs in 68 products, 35 in the last 30 days, newest from 2026-10-15.

Products

Qts - 226 CVEs
Quts Hero - 209 CVEs
Qsync Central - 68 CVEs
Qutscloud - 66 CVEs
File Station 5 - 58 CVEs
Photo Station - 18 CVEs
Video Station - 18 CVEs
Qurouter - 15 CVEs
Qumagie - 14 CVEs
Notes Station 3 - 10 CVEs
Helpdesk - 9 CVEs
Media Streaming Add-on - 9 CVEs
Music Station - 9 CVEs
Qulog Center - 8 CVEs
Qvr - 8 CVEs
Download Station - 6 CVEs
License Center - 6 CVEs
Qes - 6 CVEs
Qvr Pro - 6 CVEs
Multimedia Console - 5 CVEs
Qcalagent - 5 CVEs
Qunetswitch - 5 CVEs
Qvr Elite - 5 CVEs
Qvr Guard - 5 CVEs
Hybriddesk Station - 3 CVEs
Proxy Server - 3 CVEs
Qufirewall - 3 CVEs
Qvpn Windows - 3 CVEs
Surveillance Station - 3 CVEs
Hbs 3 - 2 CVEs
Hbs 3 Hybrid Backup Sync - 2 CVEs
Hyper Data Protector - 2 CVEs
Myqnapcloud Link - 2 CVEs
Notification Center - 2 CVEs
Nvr Storage Expansion - 2 CVEs
Qcenter - 2 CVEs
Qfinder Pro Mac - 2 CVEs
Qmailagent - 2 CVEs
Qss - 2 CVEs
Qsync For Mac - 2 CVEs
Quftp Service - 2 CVEs
Qusbcam2 - 2 CVEs
Qvpn Device Client For Mac - 2 CVEs
Viostor - 2 CVEs
Container Station - 1 CVEs
Hbs 1.3 - 1 CVEs
Hbs 2 - 1 CVEs
Image2pdf - 1 CVEs
Kazoo Server - 1 CVEs
Malware Remover - 1 CVEs
Mars Multi-application Recovery Service - 1 CVEs
Myqnapcloud - 1 CVEs
Netbak Replicator - 1 CVEs
Network Virtual Switch - 1 CVEs
Qfile - 1 CVEs
Qfiling - 1 CVEs
Qnap Ai Core - 1 CVEs
Qnap Authenticator - 1 CVEs
Qsirch - 1 CVEs
Qsw-m2116p-2t2s - 1 CVEs
Quts Cloud - 1 CVEs
Qvp - 1 CVEs
Qvr Pro Client - 1 CVEs
Qvr Smart Client - 1 CVEs
Smb Service - 1 CVEs
Smedio Dtcp Move - 1 CVEs
Viostor Nvr - 1 CVEs
Virtualization Station - 1 CVEs

Newest CVEs of Qnap Systems Inc.

CVE-2026-50619 - CVSS 9.3 (critical), 2026-10-15: A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of…
CVE-2026-47790 - CVSS 6.3 (medium), 2026-10-15: A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-47786 - CVSS 9.3 (critical), 2026-10-15: An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute…
CVE-2026-39997 - CVSS 8.9 (high), 2026-10-15: A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow…
CVE-2026-39991 - CVSS 4.8 (medium), 2026-10-15: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-34009 - CVSS 8.4 (high), 2026-10-15: An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account,…
CVE-2026-34008 - CVSS 8.5 (high), 2026-10-15: An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account,…
CVE-2026-34007 - CVSS 6.9 (medium), 2026-10-15: An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute…
CVE-2026-53882 - CVSS 8.7 (high), 2026-10-15: An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains…
CVE-2026-50612 - CVSS 9.4 (critical), 2026-10-15: An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit…
CVE-2026-44084 - CVSS 8.7 (high), 2026-10-15: An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow…
CVE-2026-41545 - CVSS 8.6 (high), 2026-10-15: A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the…
CVE-2026-41541 - CVSS 5.3 (medium), 2026-10-15: An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then…
CVE-2026-39989 - CVSS 5.3 (medium), 2026-10-15: A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then…
CVE-2026-34015 - CVSS 8.7 (high), 2026-10-15: A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability…
CVE-2026-34014 - CVSS 8.4 (high), 2026-10-15: An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an…
CVE-2026-34006 - CVSS 9.3 (critical), 2026-10-15: A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote…
CVE-2026-26245 - CVSS 8.8 (high), 2026-10-15: A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to…
CVE-2026-26244 - CVSS 8.8 (high), 2026-10-15: A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to…
CVE-2026-26243 - CVSS 7.2 (high), 2026-10-15: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability…
CVE-2026-41544 - CVSS 8.7 (high), 2026-10-15: A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to…
CVE-2026-39993 - CVSS 8.7 (high), 2026-10-15: A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-24723 - CVSS 6.5 (medium), 2026-10-15: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-24722 - CVSS 6.5 (medium), 2026-10-15: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-24721 - CVSS 6.5 (medium), 2026-10-15: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the…
CVE-2026-24718 - CVSS 5.3 (medium), 2026-10-15: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability…
CVE-2026-24715 - CVSS 5.3 (medium), 2026-10-15: An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain…
CVE-2026-22896 - CVSS 6.2 (medium), 2026-10-15: A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can…
CVE-2025-68404 - CVSS 7.5 (high), 2026-10-15: A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote…
CVE-2025-68403 - CVSS 4.6 (medium), 2026-10-15: An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account,…