QNAP
Vulnerability activity for QNAP: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 8.0HighDec 8, 2023QNAP VioStor NVR Code / command injectionCVE-2023-47565QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.Added to KEV Dec 21, 2023 · 12 days after publicationExploited73% likelyDetection
- 10.0CriticalSep 8, 2022QNAP Photo StationCVE-2022-27593Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.Added to KEV Sep 8, 2022 · same day as publicationExploited88% likelyExploit codeNucleiDetection
- 9.8CriticalDec 5, 2019QNAP Photo Station Auth bypass / access controlCVE-2019-7192QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.Added to KEV Jun 8, 2022 · 915 days after publicationExploited88% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalDec 5, 2019QNAP QTSCVE-2019-7193QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.Added to KEV Jun 8, 2022 · 915 days after publicationExploited14% likely
- 9.8CriticalDec 5, 2019QNAP Photo Station Path traversal / file handlingCVE-2019-7194QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.Added to KEV Jun 8, 2022 · 915 days after publicationExploited83% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalDec 5, 2019QNAP Photo Station Path traversal / file handlingCVE-2019-7195QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.Added to KEV Jun 8, 2022 · 915 days after publicationExploited89% likelyExploit codeMetasploit · NucleiDetection
- 8.0HighOct 28, 2020QNAP Network Attached Storage (NAS) XSSCVE-2018-19943A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.Added to KEV May 24, 2022 · 572 days after publicationExploited23% likely
- 9.8CriticalOct 28, 2020QNAP Network Attached Storage (NAS) Code / command injectionCVE-2018-19949A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.Added to KEV May 24, 2022 · 572 days after publicationExploited30% likely
- 6.1MediumOct 28, 2020QNAP Network Attached Storage (NAS) XSSCVE-2018-19953A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.Added to KEV May 24, 2022 · 572 days after publicationExploited31% likely
- 9.8CriticalApr 17, 2021QNAP Network-Attached Storage (NAS) Code / command injectionCVE-2020-2509QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.Added to KEV Apr 11, 2022 · 359 days after publicationExploited34% likelyExploit code
- 10.0CriticalMay 13, 2021QNAP Network Attached Storage (NAS) Auth bypass / access controlCVE-2021-28799QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.Added to KEV Mar 31, 2022 · 322 days after publicationExploited78% likelyExploit codeNucleiDetection
Recent
- –UnscoredOct 21, 2026QNAPADV-qnap-4fbc96153ef9Two critical vulnerabilities (collectively known as "PHP2Shell") have been reported to affect PHP, an open-source ... More
- –UnscoredMay 1, 2026QNAP Privilege escalationADV-qnap-1201558d06f8A local privilege escalation vulnerability, commonly known as "Copy Fail", has been reported to affect the Linux kernel. ... More
- –UnscoredMar 20, 2026QNAPADV-qnap-9025193a6822A missing authentication for critical function vulnerability has been reported to affect QVR Pro. If exploited, remote attackers c ... More
- –UnscoredMar 20, 2026QNAPADV-qnap-fc6818e54a7dA buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vuln ... More
- –UnscoredMar 20, 2026QNAPADV-qnap-ef44fd0e226cA cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator ... More
- –UnscoredFeb 11, 2026QNAPADV-qnap-34838ea1a20aMultiple vulnerabilities have been reported in Apache, affecting certain QNAP operating system versions. We have alre ... More
- –UnscoredFeb 11, 2026QNAPADV-qnap-8f27424ee8ddMultiple vulnerabilities have been reported in Samba, affecting certain QNAP operating system versions. We have alrea ... More
- –UnscoredJan 16, 2026QNAPADV-qnap-58014637c895A vulnerability has been reported to affect certain legacy QTS environments utilizing the NFS (Network File System) service. If ex ... More
- –UnscoredJan 2, 2026QNAPADV-qnap-8edd2587f9e2A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, remote attackers could bypass securi ... More
- 8.0HighDec 8, 2023QNAP VioStor NVR Code / command injectionCVE-2023-47565QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.Exploited73% likelyDetection
- 10.0CriticalSep 8, 2022QNAP Photo StationCVE-2022-27593Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.Exploited88% likelyExploit codeNucleiDetection
- 9.8CriticalDec 5, 2019QNAP Photo Station Path traversal / file handlingCVE-2019-7195QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.Exploited89% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalDec 5, 2019QNAP Photo Station Path traversal / file handlingCVE-2019-7194QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.Exploited83% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalDec 5, 2019QNAP QTSCVE-2019-7193QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.Exploited14% likely
- 9.8CriticalDec 5, 2019QNAP Photo Station Auth bypass / access controlCVE-2019-7192QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.Exploited88% likelyExploit codeMetasploit · NucleiDetection
- 6.1MediumOct 28, 2020QNAP Network Attached Storage (NAS) XSSCVE-2018-19953A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.Exploited31% likely
- 9.8CriticalOct 28, 2020QNAP Network Attached Storage (NAS) Code / command injectionCVE-2018-19949A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.Exploited30% likely
- 8.0HighOct 28, 2020QNAP Network Attached Storage (NAS) XSSCVE-2018-19943A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.Exploited23% likely
- 9.8CriticalApr 17, 2021QNAP Network-Attached Storage (NAS) Code / command injectionCVE-2020-2509QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.Exploited34% likelyExploit code
- 10.0CriticalMay 13, 2021QNAP Network Attached Storage (NAS) Auth bypass / access controlCVE-2021-28799QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.Exploited78% likelyExploit codeNucleiDetection
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- QNAP · Oct 21, 2026Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP ProductsADV-qnap-4fbc96153ef9
- QNAP · May 1, 2026Local Privilege Escalation Vulnerability in Linux Kernel (Copy Fail)ADV-qnap-1201558d06f8
- QNAP · Mar 20, 2026Vulnerability in Media Streaming Add-onADV-qnap-fc6818e54a7d
- QNAP · Mar 20, 2026Vulnerability in QuFTP ServiceADV-qnap-ef44fd0e226c
- QNAP · Mar 20, 2026Vulnerability in QVR ProADV-qnap-9025193a6822
- QNAP · Feb 11, 2026Vulnerabilities in SambaADV-qnap-8f27424ee8dd
- QNAP · Feb 11, 2026Vulnerabilities in ApacheADV-qnap-34838ea1a20a
- QNAP · Jan 16, 2026Vulnerability in legacy QTS with NFS service enabledADV-qnap-58014637c895
- QNAP · Jan 2, 2026Vulnerability in QuMagieADV-qnap-8edd2587f9e2
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.