Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,978 results · page 2 of 80
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_woCVE-2026-98536 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup_offline_cgwbs_workfn() drains a dying cgwb by calling cleanup_offline_cgwb() until it returns false, with a cond_resched() between passes. On a CONFIG_PREEMPTION kernel that cond_resched() does nothing: _cond_resched() is a plain "return 0", and under PREEMPT_DYNAMIC the full and lazy modes disable it. Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") those are the only two models on the architectures with PREEMPT_LAZY support, arm64 and x86 among them, so the drain loop never reports a Tasks-RCU quiescent state. A worker draining a cgwb with millions of attached inodes runs for minutes. On a 6.18 arm64 host in lazy mode the cgwb worker drained one dying cgroup's writeback domain for over 11 minutes. A BPF program unlink (bpf_trampoline_unlink_prog -> bpf_trampoline_update -> unregister_ftrace_direct -> ftrace_shutdown -> synchronize_rcu_tasks()) waited on that grace period while holding the trampoline mutex, 42 tasks queued behind it in D state, and the hung task detector fired at 614 s and panicked the host.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report whenCVE-2026-98523 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm_atomic.c:2031 at __drm_atomic_helper_set_config+0x18e/0x1b0 [drm] Call Trace: drm_client_modeset_commit_atomic+0x16b/0x220 [drm] drm_client_modeset_commit_locked+0x56/0x160 [drm] drm_client_modeset_commit+0x21/0x40 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x7b/0x80 drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] The warning is followed by a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: __drm_fb_helper_restore_fbdev_mode_unlocked.part.0+0x41/0x80 [drm_kms_helper] Call Trace: drm_fbdev_client_restore+0xe/0x20 [drm_client_lib] drm_client_dev_restore+0x9f/0xc0 [drm] drm_release+0xc5/0xe0 [drm] __fput+0xdc/0x2b0 __x64_sys_close+0x39/0x80 do_syscall_64+0x8d/0x460 entry_SYSCALL_64_after_hwframe+0x76/0x7e drm_client_register() adds the DRM client to the device client list before invoking the initial hotplug callback. If the hotplug c
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-oCVE-2026-98489 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spin forever. To avoid a soft lockup treat it as "nothing new to clean" instead. Reproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0, 4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that the ports are directly linked to: - Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap precursor, before the lockup was captured with a full trace elsewhere: atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex> 65535 (0xffff) here is the same value tpd_cons reads back once the loop below gets stuck. - Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time caught by the soft lockup watchdog with a full stack trace: watchdog: BUG: soft lock
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci_report_status() When pdev is non-NULL, zpci_repoCVE-2026-98474 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpci_report_status() When pdev is non-NULL, zpci_report_status() accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the existing device lock critical section. The lock only needs to be held when the pdev is non-NULL, so extract the pdev-specific reporting into a helper function which also adds a lockdep assertion to detect calls without the device lock held.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 16, 2026ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to accesCVE-2026-111670 · Other software · clickvisual · reported by VulnCheckMedium 5.3
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
- Product
- clickvisual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitionsCVE-2026-111666 · Other software · steedos · reported by VulnCheckMedium 5.3
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
- Product
- steedos-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values CVE-2026-111634 · Other software · helicalinsight · reported by VulnCheckHigh 8.6
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
- Product
- helicalinsight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.CVE-2026-101300 · Other software · Wegow Technologies · reported by cve-coordination@incibe.esHigh 7.1
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
- Product
- Wegow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports: Arbitrary File UploadCVE-2026-92553 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable extensions and no allow-list, MIME check, or safe-extension rename is applied. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The only server-side guard is a .htaccess file containing 'Require all denied' written by writeGuards(), which is silently ignored by nginx and by Apache configured with AllowOverride None, meaning RCE is fully achievable on those server configurations.
- Product
- YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections anCVE-2026-92777 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.4
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
- Product
- Idea Tab Pro (TB373FU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a locCVE-2026-92629 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
- Product
- Baiying PC Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue scCVE-2026-89062 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
- Product
- Energy Management Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device accCVE-2026-89057 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
- Product
- Idea Tab Pro (TB373FU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on theCVE-2026-75941 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.6
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
- Product
- Legion Zone Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user tCVE-2026-16755 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.
- Product
- Smart Camera C33
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allCVE-2026-16754 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.9
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
- Product
- Smart Camera C33
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesCVE-2026-111093 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.CVE-2026-53882 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later
- Product
- Virtualization Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsirch.CVE-2026-50619 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
- Product
- Qsirch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.CVE-2026-50612 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.4
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuMagie 2.9.2 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.CVE-2026-47790 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later
- Product
- QuFTP Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An OS command injection vulnerability has been reported to affect HybridDesk Station.CVE-2026-47786 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
- Product
- HybridDesk Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.CVE-2026-44084 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A relative path traversal vulnerability has been reported to affect QuMagie.CVE-2026-41545 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.6
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later
- Product
- QuMagie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.CVE-2026-41541 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.CVE-2026-39997 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.9
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
- Product
- HybridDesk Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.CVE-2026-39991 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.8
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.CVE-2026-39989 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2026-34015 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.CVE-2026-34014 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.4
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.CVE-2026-34009 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.4
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.CVE-2026-34008 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.5
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An OS command injection vulnerability has been reported to affect Notes Station 3.CVE-2026-34007 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.9
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
- Product
- Notes Station 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.CVE-2026-34006 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later
- Product
- sMedio DTCP MOVE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A SQL injection vulnerability has been reported to affect Video Station.CVE-2026-26245 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A SQL injection vulnerability has been reported to affect Video Station.CVE-2026-26244 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2026-26243 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect QcalAgent.CVE-2026-41544 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later
- Product
- QcalAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A relative path traversal vulnerability has been reported to affect Download Station.CVE-2026-39993 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.7
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A NULL pointer dereference vulnerability has been reported to affect File Station 5.CVE-2026-24723 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
- Product
- File Station 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A NULL pointer dereference vulnerability has been reported to affect File Station 5.CVE-2026-24722 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
- Product
- File Station 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A NULL pointer dereference vulnerability has been reported to affect File Station 5.CVE-2026-24721 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
- Product
- File Station 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Qsync Central.CVE-2026-24718 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An observable timing discrepancy vulnerability has been reported to affect QuRouter.CVE-2026-24715 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch.CVE-2026-22896 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.2
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- Network & Virtual Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.CVE-2025-68404 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An external control of system or configuration setting vulnerability has been reported to affect QuRouter.CVE-2025-68403 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.6
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66275 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66272 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.CVE-2025-29897 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.