Qnap vulnerabilities
645 vulnerabilities
Known vulnerabilities in Qnap products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 117 products.
Products
50 of 117- Qts283 vulnerabilities
- Quts Hero234 vulnerabilities
- Qsync Central63 vulnerabilities
- Qutscloud62 vulnerabilities
- File Station57 vulnerabilities
- Photo Station26 vulnerabilities
- Video Station21 vulnerabilities
- Media Streaming Add On13 vulnerabilities
- Music Station13 vulnerabilities
- Qumagie13 vulnerabilities
- Qurouter12 vulnerabilities
- Helpdesk11 vulnerabilities
- Qvr11 vulnerabilities
- Qulog Center8 vulnerabilities
- Nas Proxy Server7 vulnerabilities
- Q\'Center7 vulnerabilities
- Q\'Center Virtual Appliance7 vulnerabilities
- Hybrid Backup Sync6 vulnerabilities
- License Center6 vulnerabilities
- Notes Station 36 vulnerabilities
- Qvr Pro6 vulnerabilities
- Multimedia Console5 vulnerabilities
- Qunetswitch5 vulnerabilities
- Qvr Elite5 vulnerabilities
- Qvr Guard5 vulnerabilities
- Qes4 vulnerabilities
- QNAP Media Streaming Add On4 vulnerabilities
- QNAP QTS4 vulnerabilities
- Download Station3 vulnerabilities
- Qcalagent3 vulnerabilities
- Qufirewall3 vulnerabilities
- Qvp 21A3 vulnerabilities
- Qvp 41A3 vulnerabilities
- Qvp 41B3 vulnerabilities
- Qvp 63A3 vulnerabilities
- Qvp 63B3 vulnerabilities
- Qvp 85A3 vulnerabilities
- Qvp 85B3 vulnerabilities
- Qvpn3 vulnerabilities
- Signage Station3 vulnerabilities
- Surveillance Station3 vulnerabilities
- Viostor Network Video Recorder3 vulnerabilities
- Hyper Data Protector2 vulnerabilities
- Iartist Lite2 vulnerabilities
- Kazoo Server2 vulnerabilities
- Malware Remover2 vulnerabilities
- Myqnapcloud2 vulnerabilities
- Myqnapcloud Link2 vulnerabilities
- Nas2 vulnerabilities
- Netbak Replicator2 vulnerabilities
CVE-2026-44084qnap systems inc.video station+1
EPSS score0.41%
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-34015qnap systems inc.video station+1EPSS score0.49%
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-26245qnap systems inc.video station+1EPSS score0.51%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-26244qnap systems inc.video station+1EPSS score0.51%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-24723qnap systems inc.file station 5+1EPSS score0.28%
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5243 and laterCVE-2026-24722qnap systems inc.file station 5+1EPSS score0.28%
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5243 and laterCVE-2026-24721qnap systems inc.file station 5+1EPSS score0.28%
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5243 and laterCVE-2025-66275qnap systems inc.video station+1EPSS score0.37%
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and laterCVE-2025-66272qnap systems inc.video station+1EPSS score0.37%
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and laterCVE-2018-19947qnap systems inc.helpdesk+1EPSS score0.76%
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.CVE-2018-19945qnap systems inc.qts+1EPSS score1.12%
A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.CVE-2018-19951qnap systems inc.music station+1EPSS score0.77%
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.CVE-2018-19944qnap systems inc.qts+1EPSS score0.83%
A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed this vulnerability in the following versions: QTS 4.4.3.1354 build 20200702 (and later)CVE-2018-19942qnap systems inc.qts+5EPSS score0.75%
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)CVE-2018-19953qnap systems inc.qts+1KEVRansomwareEPSS score28.98%
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.CVE-2018-19946qnap systems inc.helpdesk+1EPSS score0.32%
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.CVE-2018-19949qnap systems inc.qts+1KEVRansomwareEPSS score28.63%
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.CVE-2018-19948qnap systems inc.helpdesk+1EPSS score0.30%
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.CVE-2018-19956qnap systems inc.photo station+1EPSS score0.92%
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.CVE-2018-19954qnap systems inc.photo station+1EPSS score0.92%
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.