QNAP Systems
Number 36 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
595
Critical
43
High
163
Known Exploited
8
Exploit available
0
Network, no login needed
23.3%
Of 570 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 162 | 7 | 30 | 51 | 74 | 0 |
| 2025 | 145 | 3 | 49 | 73 | 20 | 0 |
| 2024 | 146 | 11 | 38 | 74 | 23 | 0 |
| 2023 | 37 | 4 | 13 | 13 | 7 | 0 |
| 2022 | 22 | 2 | 8 | 12 | 0 | 0 |
| 2021 | 50 | 13 | 20 | 8 | 1 | 8 |
| 2020 | 31 | 3 | 4 | 5 | 2 | 17 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2018 | 2 | 0 | 1 | 1 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| QTS | 235 | 53 |
| Qsync Central | 68 | 21 |
| File Station 5 | 58 | 15 |
| Photo Station | 19 | 7 |
| Video Station | 18 | 12 |
| QuMagie | 15 | 9 |
| QuRouter | 15 | 7 |
| Notes Station 3 | 10 | 6 |
| QuTS hero | 10 | 1 |
| Helpdesk | 9 | 5 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 174 | 22 |
| Command Injection | 87 | 51 |
| Cross-Site Scripting | 62 | 12 |
| Path Traversal | 51 | 20 |
| SQL Injection | 26 | 20 |
| Authentication Issues | 19 | 11 |
| Format String | 15 | 2 |
| Denial of Service | 7 | 0 |
| Information Disclosure | 7 | 3 |
| Cross-Site Request Forgery | 5 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2023-47565 | Legacy VioStor NVR | High | 73.3% | |
| CVE-2022-27593 | DeadBolt Ransomware | Critical | 87.9% | |
| CVE-2021-28799 | Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) | Critical | 78.2% | |
| CVE-2020-2509 | Command Injection Vulnerability in QTS and QuTS hero | Critical | 34.0% | |
| CVE-2020-2506 | improper access control vulnerability in Helpdesk | High | 2.0% | |
| CVE-2018-19953 | QNAP Systems QTS: Cross-Site Scripting | Medium | 30.5% | |
| CVE-2018-19949 | QNAP Systems QTS: Command Injection | Critical | 30.2% | |
| CVE-2018-19943 | QNAP Systems QTS: Cross-Site Scripting | High | 22.7% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2025-62841 | Hard-coded Cryptographic Key #2 | High | 0.2% | |
| CVE-2025-62839 | Hard-coded Cryptographic Key #1 | High | 0.2% | |
| CVE-2026-53882 | Path Traversal in Virtualization Station VM Import | High | 0.4% | |
| CVE-2026-50619 | Unauthenticated remote code execution vulnerability | Critical | 0.4% | |
| CVE-2026-50612 | Import Symlink Following Remote Code Execution Vulnerability in QuMagie | Critical | 0.4% | |
| CVE-2026-47790 | Privilege Escalation via QuFTP Log-based XSS | Medium | 0.3% | |
| CVE-2026-47786 | Pre-Authentication Command Injection | Critical | 1.1% | |
| CVE-2026-44084 | Access Code Forgery in Video Station leading to unauthorized media access | High | 0.3% | |
| CVE-2026-41545 | WebSocket timelapse path traversal and command injection | High | 0.4% | |
| CVE-2026-41544 | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint | High | 0.4% |