QNAP Systems Inc. has 31 CVEs on record. Disclosure cadence is accelerating: 30 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 28. The median CVSS is 7.2 (high), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-22 (6) and CWE-79 (5). Most affected products: Qsync Central (6), Notes Station 3 (4), Download Station (3).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 30 prev 1
Products
- Qsync Central 6
- Notes Station 3 4
- Download Station 3
- QuRouter 3
- HybridDesk Station 2
- QTS 2
31
Total CVEs
4
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-50612Critical· 9.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie52CVE-2026-50619Critical· 9.3A path traversal vulnerability has been reported to affect Qsirch51CVE-2026-47786Critical· 9.3An OS command injection vulnerability has been reported to affect HybridDesk Station51CVE-2026-34006Critical· 9.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE51CVE-2026-39997High· 8.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station49
QNAP Systems Inc. vulnerabilities
CVEs affecting QNAP Systems Inc., newest first. Open any entry for full detail, references, and exploit status.
31 CVEsRSS