QNAP Systems Inc. Qcalagent vulnerabilities
5 vulnerabilities
Known vulnerabilities in QNAP Systems Inc. Qcalagent, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-41544qnap systems inc.qcalagent
EPSS score0.36%
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and laterCVE-2021-38678qnap systems inc.qcalagent+1EPSS score0.57%
An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and laterCVE-2021-38677qnap systems inc.qcalagent+1EPSS score0.70%
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and laterCVE-2024-27123qnap systems inc.qcalagentEPSS score0.13%
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.9 and laterCVE-2023-41289qnap systems inc.qcalagent+1EPSS score1.13%
An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.8 and later