QNAP security advisories, January 2026

Every QNAP security advisory published in January 2026, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 24
Critical: 2
High: 4
In CISA KEV: 0
CVEs: 24

QNAP advisories published in January 2026

Jan 2, 2026
Critical [CVE-2025-59389] SQL injection vulnerability has been reported to affect Hyper Data Protector.
Critical9.8
Jan 2, 2026
Critical [CVE-2025-11837] Malware Remover: improper control of generation of code vulnerability has been reported to affect Malware Remover.
Critical9.8
Jan 2, 2026
High [CVE-2025-9110] QTS: exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several…
High7.5
Jan 2, 2026
High [CVE-2025-62842] HBS: external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync.
High7.8
Jan 2, 2026
High [CVE-2025-59384] path traversal vulnerability has been reported to affect Qfiling.
High7.5
Jan 2, 2026
High [CVE-2025-52872] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
High8.1
Jan 2, 2026
Medium [CVE-2025-62852] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Jan 2, 2026
Medium [CVE-2025-59381] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Jan 2, 2026
Medium [CVE-2025-59380] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Jan 2, 2026
Medium [CVE-2025-53597] License Center: buffer overflow vulnerability has been reported to affect License Center.
Medium6.5
Jan 2, 2026
Medium [CVE-2025-52871] License Center: out-of-bounds read vulnerability has been reported to affect License Center.
Medium6.5
Jan 2, 2026
Medium [CVE-2025-62857] QuMagie: cross-site scripting (XSS) vulnerability has been reported to affect QuMagie.
Medium6.1
Jan 2, 2026
Medium [CVE-2025-57705] QTS: allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system…
Medium4.9
Jan 2, 2026
Medium [CVE-2025-54166] QTS: out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Jan 2, 2026
Medium [CVE-2025-53596] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Jan 2, 2026
Medium [CVE-2025-53593] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Jan 2, 2026
Medium [CVE-2025-53592] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Jan 2, 2026
Medium [CVE-2025-53591] QTS: use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions
Medium6.5
Jan 2, 2026
Medium [CVE-2025-53590] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium4.9
Jan 2, 2026
Medium [CVE-2025-47208] QTS: allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system…
Medium6.5
Jan 2, 2026
Medium [CVE-2025-44013] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium6.5
Jan 2, 2026
Low [CVE-2025-62840] generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync
Low3.3
Jan 2, 2026
Advisory [CVE-2025-59387] SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service).
Unrated
Jan 2, 2026
Advisory [CVE-2025-53594] Qsync: path traversal vulnerability has been reported to affect several product versions.
Unrated

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.