BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

QNAP Systems Inc.

QNAP Systems Inc. Security Releases - October 2026

qnap-systems-inc-2026-10 Oct 1, 2026 Source: Vendor

QNAP Systems Inc. security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2025-29895
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

35 lines
All 35 CVEs 35 Additional recognition 0 Unclaimed only
Showing 1–35 of 35 matching , clear filters
CVE-2025-29895 BR2026-0000-032326 Qsync Central unclaimed
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service ...
Credited as web_hacker
CVE-2025-29896 BR2026-0000-032350 Qsync Central unclaimed
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service ...
Credited as web_hacker
CVE-2025-29897 BR2026-0000-032351 Qsync Central unclaimed
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify me...
Credited as web_hacker
CVE-2025-66272 BR2026-0000-032352 Video Station unclaimed
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files...
Credited as Hans Yu
CVE-2025-66275 BR2026-0000-032353 Video Station unclaimed
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files...
Credited as Hans Yu
CVE-2025-68403 BR2026-0000-032354 QuRouter unclaimed
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerabilit...
Credited as 蒲宗賢
CVE-2025-68404 BR2026-0000-032355 QuRouter unclaimed
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of th...
Credited as rewhile test
CVE-2026-22896 BR2026-0000-032359 Network & Virtual Switch unclaimed
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inje...
Credited as Solanki Milan
CVE-2026-24715 BR2026-0000-032360 QuRouter unclaimed
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed th...
Credited as 蔡佳芳
CVE-2026-24718 BR2026-0000-032361 Qsync Central unclaimed
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files...
Credited as coral
CVE-2026-24721 BR2026-0000-032362 File Station 5 unclaimed
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service...
Credited as coral
CVE-2026-24722 BR2026-0000-032363 File Station 5 unclaimed
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service...
Credited as coral
CVE-2026-24723 BR2026-0000-032364 File Station 5 unclaimed
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service...
Credited as coral
CVE-2026-39993 BR2026-0000-032365 Download Station unclaimed
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unex...
Credited as Joey Tang
CVE-2026-41544 BR2026-0000-032366 QcalAgent unclaimed
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or ...
Credited as HAK-MZ TEAM
CVE-2026-26243 BR2026-0000-032411 Qsync Central unclaimed
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files...
Credited as coral
CVE-2026-26244 BR2026-0000-032412 Video Station unclaimed
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands....
Credited as williamlin254@gmail.com
CVE-2026-26245 BR2026-0000-032413 Video Station unclaimed
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands....
Credited as williamlin254@gmail.com
CVE-2026-34006 BR2026-0000-032414 sMedio DTCP MOVE unclaimed
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system....
Credited as Rd Wh
CVE-2026-34007 BR2026-0000-032415 Notes Station 3 unclaimed
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed...
Credited as Runic Labs
CVE-2026-34008 BR2026-0000-032416 Notes Station 3 unclaimed
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability...
Credited as Runic Labs
CVE-2026-34009 BR2026-0000-032417 Notes Station 3 unclaimed
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability ...
Credited as Runic Labs
CVE-2026-34014 BR2026-0000-032418 Download Station unclaimed
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vu...
Credited as Jun Rong
CVE-2026-34015 BR2026-0000-032419 Video Station unclaimed
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files...
Credited as Long Hà
CVE-2026-39989 BR2026-0000-032420 Download Station unclaimed
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read applicati...
Credited as Rd Wh
CVE-2026-39991 BR2026-0000-032421 Notes Station 3 unclaimed
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. ...
Credited as HAK-MZ team
CVE-2026-39997 BR2026-0000-032422 HybridDesk Station unclaimed
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the syste...
Credited as 이준호
CVE-2026-41541 BR2026-0000-032423 Qsync Central unclaimed
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise t...
Credited as Jun Rong
CVE-2026-41545 BR2026-0000-032424 QuMagie unclaimed
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of une...
Credited as williamlin254@gmail.com
CVE-2026-44084 BR2026-0000-032425 Video Station unclaimed
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. ...
Credited as shaolin
CVE-2026-47786 BR2026-0000-032426 HybridDesk Station unclaimed
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fi...
Credited as shaolin
CVE-2026-47790 BR2026-0000-032427 QuFTP Service unclaimed
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. W...
Credited as HAK-MZ team
CVE-2026-50612 BR2026-0000-032428 QuMagie unclaimed
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the sec...
Credited as shaolin
CVE-2026-50619 BR2026-0000-032429 Qsirch unclaimed
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have alr...
Credited as rewhile test
CVE-2026-53882 BR2026-0000-032430 Virtualization Station unclaimed
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit ...
Credited as JUNYI LIU