Threat database

CVE-2026-41544 is a path traversal vulnerability in QNAP Systems Inc.'s QcalAgent. A remote attacker with a user account can exploit this flaw to read files or system data that should be inaccessible. The vulnerability is fixed in QcalAgent version 1.1.10 and later.

CVE-2026-39993 is a relative path traversal vulnerability in QNAP Systems Inc.'s Download Station. An attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in Download Station versions 5.10.2.313 and later, and 5.11.3.322 and later.

A zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS has been exploited for remote code execution. The flaw affects the management interface of PAN-OS on PA-Series, VM-Series firewalls, and Panorama, allowing an authenticated attacker with network access to execute arbitrary code with root privileges. Palo Alto Networks has released patches and indicators of compromise (IoCs) related to limited observed exploitation. CISA has added this vulnerability to its KEV catalog, urging federal agencies to address it promptly.

CVE-2026-24723 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

CVE-2026-24722 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

CVE-2026-24721 is a NULL pointer dereference vulnerability in QNAP Systems Inc. File Station 5. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The issue has been fixed in File Station 5 version 5.5.6.5243 and later.

CVE-2026-24718 is a path traversal vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to read unexpected files or system data. The vulnerability has been fixed in Qsync Central versions 5.0.0.7 and later, 5.1.0.3 and later, 5.2.0.5 and later, and 5.3.0.2 and later.

CVE-2026-24715 is a medium severity vulnerability in QNAP Systems Inc. QuRouter involving an observable timing discrepancy (CWE-208). This flaw could allow remote attackers to obtain sensitive data. The issue affects QuRouter versions from 2.7.0 up to but not including 2.7.2.113. The vulnerability has been fixed in QuRouter version 2.7.2.113 and later.

CVE-2026-22896 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc.'s Network & Virtual Switch. It requires an attacker to have an administrator account to exploit the vulnerability by injecting malicious code. The vulnerability has been fixed in specific versions of QTS, QuTS cloud, and QuTS hero as detailed by the vendor. The CVSS 4.0 base score is 6.2, indicating a medium severity level.

CVE-2025-68404 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in QNAP Systems Inc.'s QuRouter product. This flaw could allow remote attackers to compromise system security. The vulnerability has been fixed in QuRouter version 2.6.4.001 and later.

CVE-2025-68403 is a medium severity vulnerability in QNAP Systems Inc. QuRouter that allows an attacker with local administrator access to modify system or configuration settings. The issue is classified as CWE-15 (External Control of System or Configuration Setting). The vulnerability affects QuRouter versions from 2.7.0 up to but not including 2.7.2.113. It has been fixed in version 2.7.2.113 and later.

CVE-2025-66275 is a path traversal vulnerability in QNAP Systems Inc.'s Video Station. An attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability is fixed in Video Station version 5.8.5 and later.

CVE-2025-66272 is a path traversal vulnerability in QNAP Systems Inc.'s Video Station. A remote attacker with a user account can exploit this flaw to read unauthorized files or system data. The issue is fixed in Video Station version 5.8.5 and later.

This content discusses the Burp Suite Web Academy's learning paths and topics, which are educational resources for learning web security vulnerabilities. It compares the structured 'paths' with the broader 'topics' and seeks guidance on which approach to follow for learning. There is no indication of a security vulnerability or threat in this content.

CVE-2025-29897 is a buffer copy vulnerability in QNAP Systems Inc.'s Qsync Central that allows a remote attacker with a user account to modify memory or crash processes. The issue is fixed in Qsync Central version 5.0.0.4 and later. The vulnerability has a low severity score and requires low privileges to exploit.

CVE-2025-29896 is a NULL pointer dereference vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability has been fixed in Qsync Central version 5.0.0.4 and later. The CVSS 4.0 base score is 2.3, indicating low severity.

CVE-2025-29895 is a NULL pointer dereference vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability is fixed in Qsync Central version 5.0.0.4 and later. The CVSS 4.0 base score is 2.3, indicating low severity.

CVE-2026-79822 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop TNS/X Native Inspect. This flaw may cause corruption of memory addresses and potentially redirect execution flow, leading to high impact on integrity and availability. The vulnerability requires local privileges to exploit and does not involve user interaction. It has a CVSS score of 7.1, indicating high severity. No affected versions or patch information are provided, and no known exploits are reported in the wild.

CVE-2026-110934 is an improper validation of array index vulnerability in Samsung Open Source Vyond. It allows input data manipulation that can lead to denial of service. The vulnerability affects version 0 of Vyond. The CVSS score is 4.4 (medium severity), indicating limited impact on confidentiality and integrity but high impact on availability. No patch or remediation information is currently provided.

An uncaught exception vulnerability (CWE-248) exists in Samsung Open Source Vyond before commit fb10a5c8b833df7f152d4a563a61d6090a1790d7. This flaw allows input data manipulation and results in a denial of service due to application crashes. The vulnerability has a CVSS 3.1 base score of 4.4 (medium severity).