Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Critical [CVE-2025-66276] QuTS hero: QuTS hero is not affected.
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later Affected product named by the advisory: QTS 4.3.x.
Medium [CVE-2025-62850] QuTS hero: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
Medium [CVE-2025-58468] cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center.
A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: Notification Center 1.10.0.3291 and later Affected product named by the advisory: Notification Center 1.10.x.
High [CVE-2025-59382 +16] QuTS hero: cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later Affected products named by the advisory: QuTScloud. Affected products named by the advisory: QVP 2.7.1; QuTS cloud c5.2.8; QTS version 5.2.7; QuTS hero h5.2.8.
High [CVE-2025-62851 +3] QuMagie: missing authorization vulnerability has been reported to affect QuMagie.
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later Affected products named by the advisory: License Center. Affected products named by the advisory: QuMagie 2.8.2; License Center 1.8.56.
Critical [CVE-2026-22898] QVR Pro: missing authentication for critical function vulnerability has been reported to affect QVR Pro.
A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later Affected product named by the advisory: QVR Pro 2.7.x.
High [CVE-2026-22897 +3] command injection vulnerability has been reported to affect QuNetSwitch.
A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later Affected product named by the advisory: QuNetSwitch 2.0.x.
High [CVE-2025-62843 +3] improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later Affected product named by the advisory: QuRouter 2.6.x.
Medium [CVE-2026-22895] cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuFTP Service 1.4.3 and later QuFTP Service 1.5.2 and later QuFTP Service 1.6.2 and later Affected products named by the advisory: QuFTP Service 1.4.x; QuFTP Service 1.5.x; QuFTP Service 1.6.x.
Low [CVE-2025-59383] buffer overflow vulnerability has been reported to affect Media Streaming Add-On.
A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later Affected product named by the advisory: Media Streaming Add-on 500.1.x.