Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Jun 10, 2026A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero.CVE-2025-62850 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.9.3410 build 20260214 and later QVP 2.7.4 and later QuTS cloud c5.2.9.3468 build 20260413 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026QuTS hero is not affected.CVE-2025-66276 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.2
QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026QTS, QuTS hero, QuTScloud are not affected.CVE-2025-59382 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.2
QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2025-59386 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 1.2
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026A buffer overflow vulnerability has been reported to affect several QNAP operating system versions.CVE-2025-48725 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 0.6
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45044 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45043 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45042 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45041 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-34975 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.6
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h4.5.4.2626 build 20231225 and later QTS 4.5.4.2627 build 20231225 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32970 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. QES is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2453 build 20230708 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023A vulnerability has been reported to affect QNAP device running QuTS hero, QTS.CVE-2022-27596 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS.CVE-2021-44054 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud.CVE-2021-44053 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.7
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS.CVE-2021-44052 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.5
An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS.CVE-2021-44051 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance.CVE-2021-38693 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud.CVE-2021-38674 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.2
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero.CVE-2021-34343 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero.CVE-2021-28816 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud.CVE-2018-19957 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021A command injection vulnerabilities have been reported to affect QTS and QuTS hero.CVE-2021-28804 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021A command injection vulnerabilities have been reported to affect QTS and QuTS hero.CVE-2021-28802 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2020-36194 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28806 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.7
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28798 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021A command injection vulnerability has been reported to affect QTS and QuTS hero.CVE-2020-2508 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.