QNAP

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any QNAP product.

RSS Feeds for QNAP security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in QNAP products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by QNAP Sorted by Most Security Vulnerabilities since 2018

QNAP Qts234 vulnerabilities

QNAP Quts Hero145 vulnerabilities

QNAP Qutscloud55 vulnerabilities

QNAP Qsync Central51 vulnerabilities

QNAP File Station41 vulnerabilities

QNAP Video Station19 vulnerabilities

QNAP Qumagie14 vulnerabilities

QNAP Photo Station13 vulnerabilities

QNAP Qcenter Virtual Appliance7 vulnerabilities

QNAP Download Station6 vulnerabilities

QNAP Qvr Pro6 vulnerabilities

QNAP Notes Station 36 vulnerabilities

QNAP Qcalagent5 vulnerabilities

QNAP Helpdesk5 vulnerabilities

QNAP Music Station5 vulnerabilities

QNAP Qulog Center4 vulnerabilities

QNAP Surveillance Station3 vulnerabilities

QNAP Qvpn3 vulnerabilities

Myqnapcloud2 vulnerabilities

QNAP Netbak Replicator2 vulnerabilities

QNAP Qvr Smart Client1 vulnerability

QNAP Notification Center1 vulnerability

Qnap Authenticator1 vulnerability

Known Exploited QNAP Vulnerabilities

The following QNAP vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
QNAP VioStor NVR OS Command Injection Vulnerability	QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. CVE-2023-47565 Exploit Probability: 73.3%	December 21, 2023
QNAP Photo Station Externally Controlled Reference Vulnerability	Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign. CVE-2022-27593 Exploit Probability: 87.9%	September 8, 2022
QNAP Photo Station Path Traversal Vulnerability	QNAP devices running Photo Station contains an external control of file name or path vulnerability allowing remote attackers to access or modify system files. CVE-2019-7195 Exploit Probability: 89.3%	June 8, 2022
QNAP Photo Station Path Traversal Vulnerability	QNAP devices running Photo Station contains an external control of file name or path vulnerability allowing remote attackers to access or modify system files. CVE-2019-7194 Exploit Probability: 82.7%	June 8, 2022
QNAP QTS Improper Input Validation Vulnerability	QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system. CVE-2019-7193 Exploit Probability: 14.4%	June 8, 2022
QNAP Photo Station Improper Access Control Vulnerability	QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system. CVE-2019-7192 Exploit Probability: 88.1%	June 8, 2022
QNAP NAS File Station Cross-Site Scripting Vulnerability	A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. CVE-2018-19953 Exploit Probability: 30.5%	May 24, 2022
QNAP NAS File Station Command Injection Vulnerability	A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands. CVE-2018-19949 Exploit Probability: 30.2%	May 24, 2022
QNAP NAS File Station Cross-Site Scripting Vulnerability	A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. CVE-2018-19943 Exploit Probability: 22.7%	May 24, 2022
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability	QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. CVE-2020-2509 Exploit Probability: 34.0%	April 11, 2022
QNAP NAS Improper Authorization Vulnerability	QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. CVE-2021-28799 Exploit Probability: 78.3%	March 31, 2022

Of the known exploited vulnerabilities above, 6 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 5 known exploited QNAP vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 137 vulnerabilities in QNAP with an average score of 6.8 out of ten. Last year, in 2025 QNAP had 88 security vulnerabilities published. That is, 49 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.16

Year	Vulnerabilities	Average Score
2026	137	6.84
2025	88	8.00
2024	118	7.24
2023	37	7.11
2022	19	8.46
2021	31	8.05
2020	18	7.21
2019	7	7.94
2018	26	6.60

It may take a day or so for new QNAP vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent QNAP Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-62841	Oct 29, 2026	Hardcoded Key in QNAP HBS3 Hybrid Backup Sync <26.4.0.521 Exposes RCE An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
CVE-2025-62839	Oct 29, 2026	CVE-2025-62839: Hardcoded Key in HBS 3 Hybrid Backup Sync (<26.4.0.521) An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later
CVE-2026-50619	Oct 15, 2026	QNAP Qsirch 7.0.3 Path Traversal Fix Remote File Read Vuln A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
CVE-2026-47790	Oct 15, 2026	QuFTP Service XSS before 1.4.6/1.5.5/1.6.5 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later
CVE-2026-47786	Oct 15, 2026	HybridDesk Station OS Command Injection (pre-4.2.23/4.3.4) An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
CVE-2026-39997	Oct 15, 2026	HybridDesk Station 4.2.22+ Auth Bypass in Critical Function A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
CVE-2026-39991	Oct 15, 2026	Notes Station 3 XSS Vulnerability Fixed in 3.9.12 A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later	Notes Station 3
CVE-2026-34009	Oct 15, 2026	Notes Station 3 Improper Isolation Vulnerability (v<3.9.11) An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later	Notes Station 3
CVE-2026-34008	Oct 15, 2026	Incorrect Permission Assignment in QNAP Notes Station 3 (v<3.9.11) An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later	Notes Station 3
CVE-2026-34007	Oct 15, 2026	Notes Station 3 OS Command Injection (CVE-2026-34007) fixed in 3.9.11 An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later	Notes Station 3
CVE-2026-53882	Oct 15, 2026	Virtualization Station 4.1.1.130+: Improper Link Resolution Vulnerability An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later
CVE-2026-50612	Oct 15, 2026	QuMagie 2.9.2+ Symlink Follow Vulnerability (CVE-2026-50612) An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later	Qumagie
CVE-2026-44084	Oct 15, 2026	Video Station 5.8.8: Auth Bypass via User-Controlled Key (CVE-2026-44084) An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later	Video Station
CVE-2026-41545	Oct 15, 2026	QuMagie 2.9.1+ Rel Path Traversal Fixed A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later	Qumagie
CVE-2026-41541	Oct 15, 2026	Qsync Central symlink follow vuln before 5.0.0.7 An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later	Qsync Central
CVE-2026-39989	Oct 15, 2026	SSRF in QNAP Download Station <5.10.1.312 & <5.11.2.321 A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later	Download Station
CVE-2026-34015	Oct 15, 2026	Video Station Path Traversal CVE202634015 <5.8.8, Fixed 5.8.8 A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later	Video Station
CVE-2026-34014	Oct 15, 2026	Permission Escalation in QNAP Download Station before 5.11.2.321 An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later	Download Station
CVE-2026-34006	Oct 15, 2026	Missing Auth in sMedio DTCP MOVE 1.4.5+ Remote Access A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later
CVE-2026-26245	Oct 15, 2026	SQL Injection in QNAP Video Station 5.8.8 and earlier (Video Station) A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later	Video Station
CVE-2026-26244	Oct 15, 2026	Video Station 5.8.7 and Earlier SQLi Remote Code Exec via Auth A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later	Video Station
CVE-2026-26243	Oct 15, 2026	Qsync Central PT Vulnerability (before 5.0.0.6/5.1.0.2/5.2.0.4) A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later	Qsync Central
CVE-2026-41544	Oct 15, 2026	QcalAgent Path Traversal Fixed in 1.1.10 A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later	Qcalagent
CVE-2026-39993	Oct 15, 2026	CVE-2026-39993: Path Traversal in QNAP Download Station <5.10.2.313 & <5.11.3.322 A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later	Download Station
CVE-2026-24723	Oct 15, 2026	File Station 5 DoS via NULL ptr in 5.5.5 and earlier A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-24722	Oct 15, 2026	File Station 5 NULL Pointer DoS (v5 < 5.5.6) A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-24721	Oct 15, 2026	File Station 5 DoS via NULL ptr deref before v5.5.6.5243 A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-24718	Oct 15, 2026	Path Traversal Qsync Central <5.0.0.7 · Fixed 5.1.0.3 A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later	Qsync Central
CVE-2026-24715	Oct 15, 2026	Timing Discrepancy in QNAP QuRouter 2.7.2.113 Exposed Remote Data Leak An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
CVE-2026-22896	Oct 15, 2026	XSS in QNAP Network & Virtual Switch ( <=5.2.1 ) A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
CVE-2025-68404	Oct 15, 2026	QuRouter toctou vulnerability fixed in 2.6.4.001 QNAP A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later
CVE-2025-68403	Oct 15, 2026	QuRouter External System Setting Control Vulnerability <2.7.2.113 An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
CVE-2025-66275	Oct 15, 2026	Path Traversal in QNAP Video Station <5.8.5 (Remote File Read) A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later	Video Station
CVE-2025-66272	Oct 15, 2026	Path Traversal in QNAP Video Station <5.8.5 A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later	Video Station
CVE-2025-29897	Oct 15, 2026	CVE-2025-29897: Buffer Copy Vulnerability in Qsync Central <5.0.0.4 A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later	Qsync Central
CVE-2025-29896	Oct 15, 2026	NULL ptr deref in Qsync Central <5.0.0.4, DoS, fixed in 5.0.0.4 A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later	Qsync Central
CVE-2025-29895	Oct 15, 2026	Qsync Central 5.0.0.4+ Null Pointer DoS CVE-2025-29895 A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later	Qsync Central
CVE-2024-38639	Sep 18, 2026	Improper Auth in QNAP NAS Allows Remote Compromise An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the following version:	Qts
CVE-2024-27123	Sep 18, 2026	XSS in QcalAgent before 1.1.9 A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later	Qcalagent
CVE-2026-26240	Jun 10, 2026	File Station 5 Buffer Overflow (fixed v5.5.6.5243) A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-26241	Jun 10, 2026	File Station 5 Buffer Overflow (pre-5.5.6.5243) Remote Memory Corruption A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-24724	Jun 10, 2026	QNAP File Station <=5.5.6.5243 Auth Bypass via Wrong Authorization An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-26239	Jun 10, 2026	File Station 5 Buffer Overflow via Remote User Fixed in 5.5.6.5208 A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later	File Station
CVE-2026-26237	Jun 10, 2026	QuMagie: Missing Auth Unauth Data Access, fixed v2.9.0 A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later	Qumagie
CVE-2026-24719	Jun 10, 2026	Cmd Injection in QTS 5.2.9 (pre-20260507) & QuTS hero (pre-20260514) A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later	Qts Quts Hero
CVE-2026-24717	Jun 10, 2026	QNAP QTS/QuTS Hero path traversal CVE-2026-24717 before 5.2.9.3492 A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later	Qts Quts Hero
CVE-2026-24716	Jun 10, 2026	QNAP QTS DoS via NULL ptr in 5.2.9.3492+ A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later	Qts Quts Hero
CVE-2026-24720	Jun 10, 2026	QNAP File Station 6 Unbounded Resource Allocation DoS An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later	File Station
CVE-2026-22899	Jun 10, 2026	File Station 6 NULL PTR DoS (fixed 5.5.6.5208+) A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later	File Station
CVE-2026-22893	Jun 10, 2026	CmdInject in QNAP QTS/QuTS before 5.2.9.3410 A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later	Qts Quts Hero