QNAP Systems Inc. vulnerabilities
591 vulnerabilities
Known vulnerabilities in QNAP Systems Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 68 products.
Products
50 of 68- QTS250 vulnerabilities
- Quts Hero228 vulnerabilities
- Qsync Central68 vulnerabilities
- File Station 558 vulnerabilities
- Qutscloud58 vulnerabilities
- Photo Station19 vulnerabilities
- Video Station18 vulnerabilities
- Qumagie15 vulnerabilities
- Qurouter15 vulnerabilities
- Notes Station 310 vulnerabilities
- Helpdesk9 vulnerabilities
- Media Streaming Add On9 vulnerabilities
- Music Station9 vulnerabilities
- Qulog Center8 vulnerabilities
- QVR7 vulnerabilities
- Download Station6 vulnerabilities
- License Center6 vulnerabilities
- QVR Pro6 vulnerabilities
- Multimedia Console5 vulnerabilities
- Qcalagent5 vulnerabilities
- Qunetswitch5 vulnerabilities
- QVR Elite5 vulnerabilities
- QVR Guard5 vulnerabilities
- HBS 3 Hybrid Backup Sync4 vulnerabilities
- QES4 vulnerabilities
- Hybriddesk Station3 vulnerabilities
- Proxy Server3 vulnerabilities
- Qufirewall3 vulnerabilities
- QVPN Windows3 vulnerabilities
- Surveillance Station3 vulnerabilities
- HBS 32 vulnerabilities
- Hyper Data Protector2 vulnerabilities
- Malware Remover2 vulnerabilities
- Myqnapcloud Link2 vulnerabilities
- Notification Center2 vulnerabilities
- NVR Storage Expansion2 vulnerabilities
- Q’Center2 vulnerabilities
- Qfinder Pro Mac2 vulnerabilities
- Qmailagent2 vulnerabilities
- QSS2 vulnerabilities
- Qsync For Mac2 vulnerabilities
- Quftp Service2 vulnerabilities
- Qusbcam22 vulnerabilities
- QVPN Device Client For Mac2 vulnerabilities
- Viostor2 vulnerabilities
- Container Station1 vulnerabilities
- Image2Pdf1 vulnerabilities
- Kazoo Server1 vulnerabilities
- MARS (Multi Application Recovery Service)1 vulnerabilities
- Myqnapcloud1 vulnerabilities
CVE-2026-53882qnap systems inc.virtualization station
EPSS score0.47%
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Virtualization Station 4.1.1.130 and laterCVE-2026-50619qnap systems inc.qsirchEPSS score0.43%
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsirch 7.0.3.0 and laterCVE-2026-50612qnap systems inc.qumagieEPSS score0.49%
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.2 and laterCVE-2026-47790qnap systems inc.quftp serviceEPSS score0.28%
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.
We have already fixed the vulnerability in the following version:
QuFTP Service 1.4.6 and later
QuFTP Service 1.5.5 and later
QuFTP Service 1.6.5 and laterCVE-2026-47786qnap systems inc.hybriddesk stationEPSS score1.07%
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.23 and later
HybridDesk Station 4.3.4 and laterCVE-2026-44084qnap systems inc.video station+1EPSS score0.41%
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-41545qnap systems inc.qumagieEPSS score0.54%
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.1 and laterCVE-2026-41541qnap systems inc.qsync centralEPSS score0.54%
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.7 and later
Qsync Central 5.1.0.3 and later
Qsync Central 5.2.0.5 and later
Qsync Central 5.3.0.2 and laterCVE-2026-39997qnap systems inc.hybriddesk stationEPSS score0.24%
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and laterCVE-2026-39991qnap systems inc.notes station 3EPSS score0.29%
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.12 and laterCVE-2026-39989qnap systems inc.download stationEPSS score0.43%
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and laterCVE-2026-34015qnap systems inc.video station+1EPSS score0.49%
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-34014qnap systems inc.download stationEPSS score0.13%
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and laterCVE-2026-34009qnap systems inc.notes station 3EPSS score0.14%
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and laterCVE-2026-34008qnap systems inc.notes station 3EPSS score0.12%
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and laterCVE-2026-34007qnap systems inc.notes station 3EPSS score1.64%
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
Notes Station 3 3.9.11 and laterCVE-2026-34006qnap systems inc.smedio dtcp moveEPSS score0.53%
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version:
sMedio DTCP MOVE 1.4.5 and laterCVE-2026-26245qnap systems inc.video station+1EPSS score0.51%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-26244qnap systems inc.video station+1EPSS score0.51%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and laterCVE-2026-26243qnap systems inc.qsync centralEPSS score0.54%
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.6 and later
Qsync Central 5.1.0.2 and later
Qsync Central 5.2.0.4 and later