QNAP Systems Inc. has 38 CVEs on record. Disclosure cadence is accelerating: 37 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 35. The median CVSS is 7.1 (high), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-22 (7) and CWE-476 (5). Most affected products: Qsync Central (6), Video Station (6), Notes Station 3 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 37 prev 1
Products
- Qsync Central 6
- Video Station 6
- Notes Station 3 4
- Download Station 3
- File Station 5 3
- QuRouter 3
Worst active — by depth score
CVE-2026-50612Critical· 9.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie52CVE-2026-50619Critical· 9.3A path traversal vulnerability has been reported to affect Qsirch51CVE-2026-47786Critical· 9.3An OS command injection vulnerability has been reported to affect HybridDesk Station51CVE-2026-34006Critical· 9.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE51CVE-2026-39997High· 8.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station49
QNAP Systems Inc. vulnerabilities
CVEs affecting QNAP Systems Inc., newest first. Open any entry for full detail, references, and exploit status.
38 CVEsRSS
CVE-2026-34006Critical· 9.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerabilit…
CVE-2026-26244High· 7.1A SQL injection vulnerability has been reported to affect Video Station
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerabilit…
CVE-2026-26243High· 7.2A path traversal vulnerability has been reported to affect Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …
CVE-2026-34014High· 8.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security o…
CVE-2026-26245High· 7.1A SQL injection vulnerability has been reported to affect Video Station
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerabilit…
CVE-2026-44084High· 8.7An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability …
CVE-2026-39989Medium· 5.3A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vuln…
CVE-2026-34015High· 8.7A path traversal vulnerability has been reported to affect Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …
CVE-2026-50612Critical· 9.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fi…
CVE-2026-41545High· 8.6A relative path traversal vulnerability has been reported to affect QuMagie
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have a…
CVE-2026-53882High· 8.7An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the secu…
CVE-2026-41541Medium· 5.3An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have alre…
CVE-2026-34008High· 8.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the syste…
CVE-2026-47790Medium· 6.3A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability i…
CVE-2026-39991Medium· 4.8A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability…
CVE-2026-34007Medium· 6.9An OS command injection vulnerability has been reported to affect Notes Station 3
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following vers…
CVE-2026-39997High· 8.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerabil…
CVE-2026-34009High· 8.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system…
CVE-2026-50619Critical· 9.3A path traversal vulnerability has been reported to affect Qsirch
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the foll…
CVE-2026-47786Critical· 9.3An OS command injection vulnerability has been reported to affect HybridDesk Station
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following v…
CVE-2026-41544High· 8.7A path traversal vulnerability has been reported to affect QcalAgent
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the …
CVE-2026-39993High· 8.7A relative path traversal vulnerability has been reported to affect Download Station
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have al…
CVE-2026-24723Medium· 5.3A NULL pointer dereference vulnerability has been reported to affect File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed th…
CVE-2026-24722Medium· 5.3A NULL pointer dereference vulnerability has been reported to affect File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed th…
CVE-2026-24721Medium· 5.3A NULL pointer dereference vulnerability has been reported to affect File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed th…
CVE-2026-24718Medium· 5.3A path traversal vulnerability has been reported to affect Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …
CVE-2026-24715Medium· 5.3An observable timing discrepancy vulnerability has been reported to affect QuRouter
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version…
CVE-2026-22896Medium· 6.2A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixe…
CVE-2025-68404High· 7.5A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vul…
CVE-2025-68403Medium· 4.6An external control of system or configuration setting vulnerability has been reported to affect QuRouter
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have…