QNAP security advisories, October 2026

Every QNAP security advisory published in October 2026, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 31
Critical: 4
High: 15
In CISA KEV: 0
CVEs: 31

QNAP advisories published in October 2026

Oct 29, 2026
High [CVE-2025-62841] Hybrid Backup Sync: use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync.
High8.7
Oct 15, 2026
Critical [CVE-2026-50619] path traversal vulnerability has been reported to affect Qsirch.
Critical9.3
Oct 15, 2026
Critical [CVE-2026-47786] OS command injection vulnerability has been reported to affect HybridDesk Station.
Critical9.3
Oct 15, 2026
Critical [CVE-2026-50612] QuMagie: unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.
Critical9.4
Oct 15, 2026
Critical [CVE-2026-34006] missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.
Critical9.3
Oct 15, 2026
High [CVE-2026-39997] missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.
High8.9
Oct 15, 2026
High [CVE-2026-34009] improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.
High8.4
Oct 15, 2026
High [CVE-2026-34008] incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.
High8.5
Oct 15, 2026
High [CVE-2026-53882] improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Stat…
High8.7
Oct 15, 2026
High [CVE-2026-44084] Video Station: authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.
High8.7
Oct 15, 2026
High [CVE-2026-41545] QuMagie: relative path traversal vulnerability has been reported to affect QuMagie.
High8.6
Oct 15, 2026
High [CVE-2026-34015] Video Station: path traversal vulnerability has been reported to affect Video Station.
High8.7
Oct 15, 2026
High [CVE-2026-34014] incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.
High8.4
Oct 15, 2026
High [CVE-2026-26245] Video Station: SQL injection vulnerability has been reported to affect Video Station.
High7.1
Oct 15, 2026
High [CVE-2026-26243] Qsync: path traversal vulnerability has been reported to affect Qsync Central.
High7.2
Oct 15, 2026
High [CVE-2026-41544] path traversal vulnerability has been reported to affect QcalAgent.
High8.7
Oct 15, 2026
High [CVE-2026-39993] relative path traversal vulnerability has been reported to affect Download Station.
High8.7
Oct 15, 2026
High [CVE-2025-68404] time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.
High7.5
Oct 15, 2026
High [CVE-2025-66275] Video Station: path traversal vulnerability has been reported to affect Video Station.
High7.7
Oct 15, 2026
Medium [CVE-2026-47790] cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.
Medium6.3
Oct 15, 2026
Medium [CVE-2026-39991] cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.
Medium4.8
Oct 15, 2026
Medium [CVE-2026-34007] OS command injection vulnerability has been reported to affect Notes Station 3.
Medium6.9
Oct 15, 2026
Medium [CVE-2026-41541] Qsync: unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.
Medium5.3
Oct 15, 2026
Medium [CVE-2026-39989] server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.
Medium5.3
Oct 15, 2026
Medium [CVE-2026-24723] NULL pointer dereference vulnerability has been reported to affect File Station 5.
Medium5.3
Oct 15, 2026
Medium [CVE-2026-24718] Qsync: path traversal vulnerability has been reported to affect Qsync Central.
Medium5.3
Oct 15, 2026
Medium [CVE-2026-24715] observable timing discrepancy vulnerability has been reported to affect QuRouter.
Medium5.3
Oct 15, 2026
Medium [CVE-2026-22896] QuTS hero: cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch.
Medium6.2
Oct 15, 2026
Medium [CVE-2025-68403] external control of system or configuration setting vulnerability has been reported to affect QuRouter.
Medium4.6
Oct 15, 2026
Low [CVE-2025-29897] Qsync: buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.
Low2.3
Oct 15, 2026
Low [CVE-2025-29896] Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.
Low2.3

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.