QNAP Security Advisories & CVEs
118 advisories tracked · QNAP PSIRT ([email protected] CNA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor QNAP CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your QNAP device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in QNAP's recent advisories.
Official source
QNAP PSIRT ([email protected] CNA) via NVD
QNAP is its own CVE Numbering Authority. VulniPulse ingests QNAP's CVEs from the NVD CNA feed ([email protected]), grouped by their official QSA advisory, and enriches each from the security-advisory page — the vendor's severity, affected apps/OS and the fixed build. Covers QTS, QuTS hero and QuTScloud (NAS operating systems), plus QVR, Qsync, HBS 3, Netatalk, Malware Remover, License Center and Photo/Video/Music Station — QNAP NAS are a relentless ransomware target (DeadBolt, Qlocker), so an alert-hungry community.
Latest QNAP advisories
High [CVE-2026-39997] missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
High [CVE-2026-34009] improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
High [CVE-2026-34008] incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
High [CVE-2026-53882] improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Stat…
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later
High [CVE-2026-44084] Video Station: authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
High [CVE-2026-41545] QuMagie: relative path traversal vulnerability has been reported to affect QuMagie.
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later
High [CVE-2026-34015] Video Station: path traversal vulnerability has been reported to affect Video Station.
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
High [CVE-2026-34014] incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later
High [CVE-2026-26245] Video Station: SQL injection vulnerability has been reported to affect Video Station.
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
High [CVE-2026-26243] Qsync: path traversal vulnerability has been reported to affect Qsync Central.
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later
High [CVE-2026-41544] path traversal vulnerability has been reported to affect QcalAgent.
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later
High [CVE-2026-39993] relative path traversal vulnerability has been reported to affect Download Station.
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later
High [CVE-2025-68404] time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later
High [CVE-2025-66275] Video Station: path traversal vulnerability has been reported to affect Video Station.
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
High [CVE-2026-22897 +3] command injection vulnerability has been reported to affect QuNetSwitch.
A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later Affected product named by the advisory: QuNetSwitch 2.0.x.
High [CVE-2025-62843 +3] improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.
An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later Affected product named by the advisory: QuRouter 2.6.x.
High [CVE-2025-9110] QTS: exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several…
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.1.3250 build 20250912 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.
High [CVE-2025-62842] HBS: external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync.
An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read or modify files or directories. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.2.0.938 and later Affected product named by the advisory: HBS 3 Hybrid Backup Sync 26.1.x and earlier.
High [CVE-2025-59384] path traversal vulnerability has been reported to affect Qfiling.
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qfiling 3.13.1 and later Affected product named by the advisory: Qfiling 3.13.x.
High [CVE-2025-52872] QTS: buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 build 20250716 and later Affected products named by the advisory: QTS 5.2.x; QuTS hero h5.2.x; QuTS hero h5.3.x.