By year
09
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited QNAP Systems flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2023-47565 QNAP VioStor NVR OS Command InjectionExploited since Dec 21, 2023 · CVSS 8
- CVE-2022-27593 QNAP Photo Station Externally Controlled ReferenceExploited since Sep 8, 2022 · ransomware · CVSS 10
- CVE-2019-7192 QNAP Photo Station Improper Access ControlExploited since Jun 8, 2022 · ransomware · CVSS 9.8
- CVE-2019-7195 QNAP Photo Station Path TraversalExploited since Jun 8, 2022 · ransomware · CVSS 9.8
- CVE-2019-7194 QNAP Photo Station Path TraversalExploited since Jun 8, 2022 · ransomware · CVSS 9.8
- CVE-2019-7193 QNAP QTS Improper Input ValidationExploited since Jun 8, 2022 · ransomware · CVSS 9.8
- CVE-2018-19949 QNAP NAS File Station Command InjectionExploited since May 24, 2022 · ransomware · CVSS 9.8
- CVE-2018-19943 QNAP NAS File Station Cross-Site ScriptingExploited since May 24, 2022 · ransomware · CVSS 8
- CVE-2018-19953 QNAP NAS File Station Cross-Site ScriptingExploited since May 24, 2022 · ransomware · CVSS 6.1
- CVE-2020-2509 QNAP Network-Attached Storage (NAS) Command InjectionExploited since Apr 11, 2022 · CVSS 9.8
- CVE-2021-28799 QNAP NAS Improper AuthorizationExploited since Mar 31, 2022 · ransomware · CVSS 10
- CVE-2020-2506 QNAP Helpdesk Improper Access ControlExploited since Mar 25, 2022 · CVSS 7.3
Latest high and critical flaws
- CVE-2026-53882 An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.High 8.7 · Oct 15, 2026
- CVE-2026-50619 A path traversal vulnerability has been reported to affect Qsirch.Critical 9.3 · Oct 15, 2026
- CVE-2026-50612 An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.Critical 9.4 · Oct 15, 2026
- CVE-2026-47786 An OS command injection vulnerability has been reported to affect HybridDesk Station.Critical 9.3 · Oct 15, 2026
- CVE-2026-44084 An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.High 8.7 · Oct 15, 2026
- CVE-2026-41545 A relative path traversal vulnerability has been reported to affect QuMagie.High 8.6 · Oct 15, 2026
- CVE-2026-39997 A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.High 8.9 · Oct 15, 2026
- CVE-2026-34015 A path traversal vulnerability has been reported to affect Video Station.High 8.7 · Oct 15, 2026
- CVE-2026-34014 An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.High 8.4 · Oct 15, 2026
- CVE-2026-34009 An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.High 8.4 · Oct 15, 2026
- CVE-2026-34008 An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.High 8.5 · Oct 15, 2026
- CVE-2026-34006 A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.Critical 9.3 · Oct 15, 2026
- CVE-2026-26245 A SQL injection vulnerability has been reported to affect Video Station.High 7.1 · Oct 15, 2026
- CVE-2026-26244 A SQL injection vulnerability has been reported to affect Video Station.High 7.1 · Oct 15, 2026
- CVE-2026-26243 A path traversal vulnerability has been reported to affect Qsync Central.High 7.2 · Oct 15, 2026
- CVE-2026-41544 A path traversal vulnerability has been reported to affect QcalAgent.High 8.7 · Oct 15, 2026
- CVE-2026-39993 A relative path traversal vulnerability has been reported to affect Download Station.High 8.7 · Oct 15, 2026
- CVE-2025-68404 A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.High 7.5 · Oct 15, 2026
- CVE-2025-66275 A path traversal vulnerability has been reported to affect Video Station.High 7.7 · Oct 15, 2026
- CVE-2025-66272 A path traversal vulnerability has been reported to affect Video Station.High 7.7 · Oct 15, 2026
- CVE-2026-22893 A command injection vulnerability has been reported to affect several QNAP operating system versions.High 8.6 · Jun 10, 2026
- CVE-2025-66279 A command injection vulnerability has been reported to affect several QNAP operating system versions.High 8.6 · Jun 10, 2026
- CVE-2025-66273 A command injection vulnerability has been reported to affect several QNAP operating system versions.High 8.6 · Jun 10, 2026
- CVE-2025-66276 QuTS hero is not affected.Critical 9.2 · Jun 9, 2026
- CVE-2026-44083 An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie.High 8.7 · Jun 9, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.