QTS vulnerabilities
CVEs whose affected-version data names the QTS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
45 CVEsRSS
CVE-2025-59385Critical· 9.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions
An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to access resources which are not otherwise accessible without…
CVE-2025-33032Medium· 4.9A path traversal vulnerability has been reported to affect several QNAP operating system versions
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or s…
CVE-2025-30274Medium· 6.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in t…
CVE-2025-30273High· 8.1An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fix…
CVE-2025-30272Medium· 6.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in t…
CVE-2025-30271Medium· 6.5A path traversal vulnerability has been reported to affect several QNAP operating system versions
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data…
CVE-2025-30270Medium· 6.5A path traversal vulnerability has been reported to affect several QNAP operating system versions
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data…
CVE-2025-30268Medium· 6.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. …
CVE-2025-30267Medium· 6.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. …
CVE-2025-30265Medium· 6.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already …
CVE-2025-30264High· 8.8A command injection vulnerability has been reported to affect several QNAP operating system versions
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixe…
CVE-2025-29882Medium· 6.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. …
CVE-2018-19953Medium· 6.1CISA KEVPoCIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 202001…
CVE-2018-19949Critical· 9.8CISA KEVPoCIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130…
CVE-2018-19943High· 8.0CISA KEV0dayIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build …