QNAP Notes Station 3
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in QNAP Notes Station 3.
By the Year
In 2026 there have been 4 vulnerabilities in QNAP Notes Station 3 with an average score of 7.2 out of ten. Notes Station 3 did not have any published security vulnerabilities last year. That is, 4 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 4 | 7.15 |
| 2025 | 0 | 0.00 |
| 2024 | 2 | 5.40 |
It may take a day or so for new Notes Station 3 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent QNAP Notes Station 3 Security Vulnerabilities
Notes Station 3 XSS Vulnerability Fixed in 3.9.12
CVE-2026-39991
4.8 - Medium
- October 15, 2026
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
XSS
Notes Station 3 Improper Isolation Vulnerability (v<3.9.11)
CVE-2026-34009
8.4 - High
- October 15, 2026
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Separation of Privilege
Incorrect Permission Assignment in QNAP Notes Station 3 (v<3.9.11)
CVE-2026-34008
8.5 - High
- October 15, 2026
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Incorrect Permission Assignment for Critical Resource
Notes Station 3 OS Command Injection (CVE-2026-34007) fixed in 3.9.11
CVE-2026-34007
6.9 - Medium
- October 15, 2026
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Shell injection
Notes Station 3 XSS via Authenticated Network Payload (pre-3.9.6)
CVE-2024-27126
5.4 - Medium
- September 06, 2024
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: Notes Station 3 3.9.6 and later
XSS
CVE-2024-27122 XSS in Notes Station 3 Auth User Code Injection (fixed 3.9.6)
CVE-2024-27122
5.4 - Medium
- September 06, 2024
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: Notes Station 3 3.9.6 and later
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for QNAP Notes Station 3 or by QNAP? Click the Watch button to subscribe.
