QNAP Applications Vulnerabilities & Security Advisories
81 advisories tracked · QNAP PSIRT ([email protected] CNA) via NVD · 3 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published QNAP advisory that VulniPulse classified as Applications, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 11 critical, 31 high, 34 medium, 3 low.
Android app · Google Play
Monitor QNAP CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
QNAP PSIRT ([email protected] CNA) via NVD
QNAP is its own CVE Numbering Authority. VulniPulse ingests QNAP's CVEs from the NVD CNA feed ([email protected]), grouped by their official QSA advisory, and enriches each from the security-advisory page — the vendor's severity, affected apps/OS and the fixed build. Covers QTS, QuTS hero and QuTScloud (NAS operating systems), plus QVR, Qsync, HBS 3, Netatalk, Malware Remover, License Center and Photo/Video/Music Station — QNAP NAS are a relentless ransomware target (DeadBolt, Qlocker), so an alert-hungry community.
Latest QNAP Applications advisories
Low [CVE-2025-29897] Qsync: buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Low [CVE-2025-29896] Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
Low [CVE-2023-47219] QuMagie: SQL injection vulnerability has been reported to affect QuMagie.
A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later