Export limit exceeded: 10242 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-34014 | 1 Qnap Systems | 1 Download Station | 2026-11-10 | N/A |
| An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later | ||||
| CVE-2025-62839 | 3 Qnap, Qnap Systems, Qnap Systems Inc. | 3 Hybrid Backup Sync, Hbs 3 Hybrid Backup Sync, Hbs 3 Hybrid Backup Sync | 2026-10-30 | N/A |
| An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later | ||||
| CVE-2025-62841 | 3 Qnap, Qnap Systems, Qnap Systems Inc. | 3 Hybrid Backup Sync, Hbs 3 Hybrid Backup Sync, Hbs 3 Hybrid Backup Sync | 2026-10-30 | N/A |
| An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later | ||||
| CVE-2026-34006 | 1 Qnap Systems | 1 Smedio Dtcp Move | 2026-10-26 | N/A |
| A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later | ||||
| CVE-2026-53882 | 1 Qnap Systems | 1 Virtualization Station | 2026-10-26 | N/A |
| An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later | ||||
| CVE-2026-47790 | 1 Qnap Systems | 1 Quftp Service | 2026-10-24 | N/A |
| A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later | ||||
| CVE-2026-50612 | 2 Qnap Systems, Qnap Systems Inc. | 2 Qumagie, Qumagie | 2026-10-23 | N/A |
| An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later | ||||
| CVE-2026-39989 | 1 Qnap Systems | 1 Download Station | 2026-10-22 | N/A |
| A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later | ||||
| CVE-2026-39991 | 1 Qnap Systems | 1 Notes Station | 2026-10-22 | N/A |
| A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later | ||||
| CVE-2026-39997 | 1 Qnap Systems | 1 Hybriddesk Station | 2026-10-22 | N/A |
| A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later | ||||
| CVE-2026-47786 | 1 Qnap Systems | 1 Hybriddesk Station | 2026-10-21 | N/A |
| An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later | ||||
| CVE-2025-29897 | 1 Qnap Systems | 1 Qsync Central | 2026-10-19 | N/A |
| A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later | ||||
| CVE-2026-41544 | 1 Qnap Systems | 1 Qcalagent | 2026-10-19 | N/A |
| A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later | ||||
| CVE-2026-22896 | 1 Qnap Systems | 1 Network & Virtual Switch | 2026-10-19 | N/A |
| A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later | ||||
| CVE-2026-41541 | 1 Qnap Systems | 1 Qsync Central | 2026-10-17 | N/A |
| An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | ||||
| CVE-2026-41545 | 2 Qnap Systems, Qnap Systems Inc. | 2 Qumagie, Qumagie | 2026-10-17 | N/A |
| A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later | ||||
| CVE-2026-24715 | 1 Qnap Systems | 1 Qurouter | 2026-10-17 | N/A |
| An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later | ||||
| CVE-2026-24721 | 2 Qnap, Qnap Systems | 2 File Station, File Station 5 | 2026-10-17 | 6.5 Medium |
| A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | ||||
| CVE-2026-24718 | 1 Qnap Systems | 1 Qsync Central | 2026-10-17 | N/A |
| A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | ||||
| CVE-2026-26243 | 1 Qnap Systems | 1 Qsync Central | 2026-10-17 | N/A |
| A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later | ||||