QNAP vulnerabilities
We track 252 vulnerabilities in QNAP products across 60+ products. 250 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest QNAP vulnerabilities
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the follo
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabilit
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabilit
- 8.8 High severity
QTS: Double Free
A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network. We have already fixed the vulnerability in the following ve
- 8.1 High severity
QTS: Exposure of Sensitive Information to an Unauthorized Actor
An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have alr
- 10.0 Critical severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 9.9 Critical severity
myQNAPcloud Link: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability i
- 7.5 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 8.2 High severity
QTS: Integer Overflow or Wraparound
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerabilit
- 7.5 High severity
QTS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vul
- 7.5 High severity
QTS: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vul
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabilit
- 8.1 High severity
QTS: Improper Authorization
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnera
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabilit
- 8.8 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabilit
- 9.8 Critical severity
Media Streaming add-on: Improper Limitation of a Pathname to a Restricted Directory
An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the foll
- 9.8 Critical severity
QTS: Improper Authentication
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in th
- 8.4 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 8.3 High severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 8.8 High severity
QTS: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following v
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 8.1 High severity
Qsync Central: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerabil
- 8.8 High severity
Photo Station: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 9.8 Critical severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Buffer Copy without Checking Size of Input
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vul
- 7.2 High severity
QTS: Out-of-bounds Write
A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in th
- 9.8 Critical severity
QTS: Improper Authentication
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in th