Threat database

CVE-2026-50619 is a critical path traversal vulnerability in QNAP Systems Inc.'s Qsirch product. This flaw allows remote attackers to read arbitrary files or system data outside the intended directories. The vulnerability affects Qsirch versions from 7.0.0 up to but not including 7.0.3.0. It has been fixed in version 7.0.3.0 and later.

CVE-2026-47790 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc.'s QuFTP Service. The flaw allows a remote attacker with a user account to inject malicious code. The vulnerability has been fixed in QuFTP Service versions 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later.

CVE-2026-47786 is a critical OS command injection vulnerability in QNAP Systems Inc.'s HybridDesk Station. This flaw allows remote attackers to execute arbitrary commands without authentication. The vulnerability affects versions 4.2.x prior to 4.2.23 and 4.3.x prior to 4.3.4. Fixed versions 4.2.23 and later, and 4.3.4 and later, have addressed this issue.

CVE-2026-39997 is a high-severity vulnerability in QNAP Systems Inc.'s HybridDesk Station where a missing authentication for a critical function could allow remote attackers to gain system access. The issue is fixed in version 4.2.22 and later.

CVE-2026-39991 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc. Notes Station 3. A remote attacker with a user account can exploit this flaw to inject malicious code. The issue is fixed in Notes Station 3 version 3.9.12 and later.

CVE-2026-34009 is an improper isolation or compartmentalization vulnerability in QNAP Systems Inc. Notes Station 3. A local attacker with administrator privileges can exploit this flaw to compromise system security. The vulnerability has been fixed in Notes Station 3 version 3.9.11 and later.

CVE-2026-34008 is a high-severity vulnerability in QNAP Systems Inc. Notes Station 3 involving incorrect permission assignment for a critical resource. A local attacker with a user account can exploit this flaw to compromise system security. The issue is fixed in Notes Station 3 version 3.9.11 and later.

CVE-2026-34007 is an OS command injection vulnerability in QNAP Systems Inc. Notes Station 3. This flaw allows remote attackers to execute arbitrary commands on affected systems. The vulnerability affects versions from 3.9.x up to but not including 3.9.11. A fix has been released in version 3.9.11 and later. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-53882 is a high-severity vulnerability in QNAP Systems Inc. Virtualization Station involving improper link resolution before file access (CWE-59). A remote attacker with a user account can exploit this flaw to compromise system security. The issue is fixed in Virtualization Station version 4.1.1.130 and later.

CVE-2026-50612 is a critical vulnerability in QNAP Systems Inc. QuMagie involving a Unix symbolic link (symlink) following flaw. A remote attacker with a user account can exploit this to compromise system security. The issue is fixed in QuMagie version 2.9.2 and later.

CVE-2026-44084 is an authorization bypass vulnerability in QNAP Systems Inc. Video Station. It involves a user-controlled key that could allow remote attackers to access sensitive data without proper authorization. The issue has been fixed in Video Station version 5.8.8 and later.

CVE-2026-41545 is a relative path traversal vulnerability in QNAP Systems Inc.'s QuMagie product. An attacker with administrator privileges can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in QuMagie version 2.9.1 and later.

CVE-2026-41541 is a medium severity vulnerability in QNAP Systems Inc.'s Qsync Central involving a Unix symbolic link (symlink) following issue. A remote attacker with a user account can exploit this vulnerability to compromise system security. The vulnerability has been fixed in Qsync Central versions 5.0.0.7 and later, 5.1.0.3 and later, 5.2.0.5 and later, and 5.3.0.2 and later.

CVE-2026-39989 is a server-side request forgery (SSRF) vulnerability in QNAP Systems Inc. Download Station. A remote attacker with a user account can exploit this flaw to read application data. The vulnerability has been fixed in Download Station versions 5.10.1.312 and later, and 5.11.2.321 and later. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-34015 is a path traversal vulnerability in QNAP Systems Inc. Video Station that allows a remote attacker with a user account to read unexpected files or system data. The vulnerability is fixed in Video Station version 5.8.8 and later. Versions from 5.8.x up to but not including 5.8.8 are affected. The CVSS 4.0 score is 8.7, indicating high severity.

CVE-2026-34014 is a high-severity vulnerability in QNAP Systems Inc.'s Download Station involving incorrect permission assignment for a critical resource. A local attacker with administrator privileges can exploit this flaw to compromise system security. The issue has been fixed in Download Station versions 5.10.1.312 and later, and 5.11.2.321 and later.

CVE-2026-34006 is a critical vulnerability in QNAP Systems Inc.'s sMedio DTCP MOVE software caused by missing authentication for a critical function. This flaw allows remote attackers to gain unauthorized access to the system without any privileges or user interaction. The vulnerability has been fixed in version 1.4.5 and later.

CVE-2026-26245 is a SQL injection vulnerability in QNAP Systems Inc. Video Station. It allows a remote attacker with a user account to execute unauthorized code or commands. The issue is fixed in Video Station version 5.8.8 and later. Versions from 5.8.x up to but not including 5.8.8 are affected. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.

CVE-2026-26244 is a SQL injection vulnerability in QNAP Systems Inc.'s Video Station product. It allows a remote attacker with a user account to execute unauthorized code or commands. The vulnerability is fixed in Video Station version 5.8.8 and later.

CVE-2026-26243 is a path traversal vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in versions 5.0.0.6 and later, 5.1.0.2 and later, and 5.2.0.4 and later. The CVSS 4.0 score is 7.2, indicating high severity.