Known Vulnerabilities for products from QNAP
Listed below are 20 of the newest known vulnerabilities associated with the vendor "QNAP".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Additional devices specifications by QNAP can be found at device.report : QNAP
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-44083 json | An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers c... | Not Provided | 2026-06-09 | 2026-06-12 |
| CVE-2026-41539 json | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote att... | Not Provided | 2026-06-09 | 2026-06-12 |
| CVE-2026-26241 json | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnera... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-26240 json | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnera... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-26239 json | A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they c... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-26237 json | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerab... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-26236 json | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerab... | Not Provided | 2026-06-09 | 2026-06-12 |
| CVE-2026-24724 json | An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user accoun... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-24720 json | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-24719 json | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker ga... | Not Provided | 2026-06-10 | 2026-06-15 |
| CVE-2026-24717 json | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-24716 json | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote atta... | Not Provided | 2026-06-10 | 2026-06-15 |
| CVE-2026-22899 json | A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user accoun... | Not Provided | 2026-06-10 | 2026-06-12 |
| CVE-2026-22898 json | A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can th... | Not Provided | 2026-03-20 | 2026-04-14 |
| CVE-2026-22895 json | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administr... | Not Provided | 2026-03-20 | 2026-06-09 |
| CVE-2026-22893 json | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker ga... | Not Provided | 2026-06-10 | 2026-06-15 |
| CVE-2025-66281 json | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attac... | Not Provided | 2026-06-10 | 2026-06-15 |
| CVE-2025-66280 json | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remo... | Not Provided | 2026-06-10 | 2026-06-15 |
| CVE-2025-66279 json | Not Provided | 2026-06-10 | 2026-06-11 | |
| CVE-2025-66276 json | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 a... | Not Provided | 2026-06-10 | 2026-06-12 |
Known software with vulnerabilities from QNAP
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Qnap | Helpdesk | 1.0.06 |
| Application | Qnap | Iartist Lite | 1.4.53.1 |
| Application | Qnap | Multimedia Console | 1.0.0 |
| Application | Qnap | Music Station | 4.8.0 |
| Application | Qnap | Myqnapcloud | 1.3.3.0925 |
| Application | Qnap | Nas Proxy Server | 1.3.0 |
| Application | Qnap | Netbak Replicator | 4.5.11.816 |
| Application | Qnap | Photo Station | 5.2.0 |
| Application | Qnap | Qes | 1.1.4 |
| Application | Qnap | Qfinder Pro | 6.1.0.0317 |
| Application | Qnap | Qsync | 4.2.2.0724 |
| Operating System | Qnap | Qts | - |
| Application | Qnap | Qts | 4.3.3.0174 |
| Application | Qnap | Qts Helpdesk | 1.1.12 |
| Application | Qnap | Quts Hero | h4.5.0 |
| Application | Qnap | Qcenter | 1.1.15 |
| Application | Qnap | Signage Station | 2.0 |
| Hardware | Qnap | Ss-839 | - |
| Operating System | Qnap | Ss-839 Firmware | 4.0.7 |
| Application | Qnap | Surveillance Station | 5.0.3 |