QNAP Security Advisories & CVEs
169 advisories tracked · QNAP PSIRT ([email protected] CNA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor QNAP CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your QNAP device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in QNAP's recent advisories.
Official source
QNAP PSIRT ([email protected] CNA) via NVD
QNAP is its own CVE Numbering Authority. VulniPulse ingests QNAP's CVEs from the NVD CNA feed ([email protected]), grouped by their official QSA advisory, and enriches each from the security-advisory page — the vendor's severity, affected apps/OS and the fixed build. Covers QTS, QuTS hero and QuTScloud (NAS operating systems), plus QVR, Qsync, HBS 3, Netatalk, Malware Remover, License Center and Photo/Video/Music Station — QNAP NAS are a relentless ransomware target (DeadBolt, Qlocker), so an alert-hungry community.
Latest QNAP advisories
Medium [CVE-2025-52871] License Center: out-of-bounds read vulnerability has been reported to affect License Center.
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: License Center 2.0.36 and later Affected product named by the advisory: License Center 2.0.x.
Medium [CVE-2025-62857] QuMagie: cross-site scripting (XSS) vulnerability has been reported to affect QuMagie.
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later Affected product named by the advisory: QuMagie 2.x.
Medium [CVE-2025-57705] QTS: allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system…
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-54166] QTS: out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions.
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-53596] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-53593] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-53592] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-53591] QTS: use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-53590] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-47208] QTS: allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system…
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-44013] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
Medium [CVE-2025-58465] cross-site scripting (XSS) vulnerability has been reported to affect Download Station.
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Affected products named by the advisory: Download Station 5.10.x (for QTS 5.2.1); Download Station 5.10.x (for QuTS hero h5.2.1).
Medium [CVE-2025-58463] relative path traversal vulnerability has been reported to affect Download Station.
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Affected products named by the advisory: Download Station 5.10.x (for QTS 5.2.1); Download Station 5.10.x (for QuTS hero h5.2.1).
Medium [CVE-2025-57712] Qsync: path traversal vulnerability has been reported to affect Qsync Central.
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.3 ( 2025/08/28 ) and later Affected product named by the advisory: Qsync Central 5.0.x.
Medium [CVE-2025-57706] cross-site scripting (XSS) vulnerability has been reported to affect File Station 5.
A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Affected product named by the advisory: File Station 5 version 5.5.x.
Medium [CVE-2025-54168] cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center.
A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.923 ( 2025/08/27 ) and later Affected product named by the advisory: QuLog Center 1.8.x.
Medium [CVE-2025-53413] allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Affected product named by the advisory: File Station 5 version 5.5.x.
Medium [CVE-2025-53412] NULL pointer dereference vulnerability has been reported to affect File Station 5.
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Affected product named by the advisory: File Station 5 version 5.5.x.
Medium [CVE-2025-53411] allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5.
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Affected product named by the advisory: File Station 5 version 5.5.x.
Medium [CVE-2025-47207] NULL pointer dereference vulnerability has been reported to affect several product versions.
A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Affected product named by the advisory: File Station 5 version 5.5.x.