QNAP QTS security vulnerabilities
Networking / NAS. Public CVE monitoring for QNAP QTS. Vendor security advisories are linked on this page.
Built for Operators of this product.
200 public records · 0 security-fix timeline events. 0 published in the last 7 days. 135 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 4
- High 16
- Medium 12
- Low 3
2026-08-0335 issues2026-10-31
Known exploited
View all known exploited- High8.1QNAP malware_remover Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.52%Jan 2, 2026
- High8.8QNAP music_station Improper AuthenticationPatch nowKEVEPSS 1.24%Sep 6, 2024
- High8.8QNAP VioStor NVR OS Command Injection VulnerabilityPatch nowKEVEPSS 73.28%Dec 8, 2023
- Critical9.1QNAP Photo Station Externally Controlled Reference VulnerabilityPatch nowKEVEPSS 87.91%May 18, 2022
- Critical9.8QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityPatch nowKEVEPSS 33.99%Apr 16, 2021
- Medium6.1QNAP NAS File Station Cross-Site Scripting VulnerabilityPatch nowKEVEPSS 30.53%Oct 28, 2020
- Medium5.4QNAP NAS File Station Cross-Site Scripting VulnerabilityPatch nowKEVEPSS 22.68%Oct 28, 2020
- Critical9.8QNAP QTS Improper Input Validation VulnerabilityPatch nowKEVEPSS 14.37%Dec 5, 2019
Recently published
Browse catalog- Critical9.3A path traversal vulnerability has been reported to affect Qsirch.Check if you run itEPSS 0.43%Oct 15, 2026
- Medium6.3A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.Check if you run itEPSS 0.28%Oct 15, 2026
- Critical9.3An OS command injection vulnerability has been reported to affect HybridDesk Station.Check if you run itEPSS 1.07%Oct 15, 2026
- High8.9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.Check if you run itEPSS 0.24%Oct 15, 2026
- Medium4.8A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.Check if you run itEPSS 0.29%Oct 15, 2026
- High8.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.Check if you run itEPSS 0.11%Oct 15, 2026
- High8.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.Check if you run itEPSS 0.10%Oct 15, 2026
- Medium6.9An OS command injection vulnerability has been reported to affect Notes Station 3.Check if you run itEPSS 1.45%Oct 15, 2026
- High8.7An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.Check if you run itEPSS 0.36%Oct 15, 2026
- Critical9.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.Check if you run itEPSS 0.38%Oct 15, 2026