QT
Product
QTS
On CISA KEVExploited in the wildRansomware-linked
283
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 43High 115Medium 120Low 3
Watch
Add QTS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-2509 In wildKEV | 9.8 | Apr 17 | Command Injection Vulnerability in QTS and QuTS hero Affected: before 4.2.6; 4.3.5 before 4.3.6; 4.4.0 before 4.5.1; 4.2.6; 4.2.6; 4.2.6; +34 more |
| CVE-2018-19949 RansomwareIn wildKEV | 9.8 | Oct 28 | QNAP NAS File Station Command Injection Vulnerability Affected: before 4.2.6; 4.3.1.0013 before 4.3.3.1161; 4.3.4 before 4.3.4.1190; 4.3.6 before 4.3.6.1218; 4.4.0 before 4.4.1.1201; 4.4.2 before 4.4.2.1231; +6 more |
| CVE-2019-7193 RansomwareIn wildKEV | 9.8 | Dec 5 | QNAP QTS Improper Input Validation Vulnerability Affected: 4.3.6.0895; 4.3.6.0907; 4.3.6.0923; 4.3.6.0944; 4.3.6.0959; 4.3.6.0979; +10 more |
| CVE-2014-7169 In wildKEV | 9.8 | Sep 25 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: before 4.1.1; 4.1.1; 4.1.1 |
| CVE-2014-6271 In wildKEV | 9.8 | Sep 24 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: before 4.1.1; 4.1.1; 4.1.1 |
| CVE-2018-19953 RansomwareIn wildKEV | 6.1 | Oct 28 | QNAP NAS File Station Cross-Site Scripting Vulnerability Affected: before 4.2.6; 4.3.1.0013 before 4.3.3.1161; 4.3.4 before 4.3.4.1190; 4.3.6 before 4.3.6.1218; 4.4.0 before 4.4.1.1201; 4.4.2 before 4.4.2.1231; +6 more |
| CVE-2018-19943 RansomwareIn wildKEV | 5.4 | Oct 28 | QNAP NAS File Station Cross-Site Scripting Vulnerability Affected: before 4.2.6; 4.3.1.0013 before 4.3.3.1252; 4.3.4 before 4.3.4.1282; 4.3.6 before 4.3.6.1263; 4.4.0 before 4.4.1.1261; 4.4.2 before 4.4.2.1270; +10 more |
| CVE-2024-32766 | 10.0 | Apr 26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: before 4.5.4.2627; 5.0.0 before 5.1.3.2578; 4.5.4.2627; 5.1.3.2578 |
| CVE-2017-7876 | 10.0 | Jun 15 | This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application Affected: through 4.2.6 |
| CVE-2025-66276 | 9.8 | Jun 10 | QuTS hero is not affected Affected: 4.3.0 before 5.2.7.3256 |
| CVE-2025-66277 | 9.8 | Feb 11 | A link following vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +13 more |
| CVE-2025-62849 | 9.8 | Dec 16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +11 more |
| CVE-2025-59385 | 9.8 | Dec 16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +11 more |
| CVE-2024-50393 | 9.8 | Dec 6 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +16 more |
| CVE-2024-21899 | 9.8 | Mar 8 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: before 4.5.4.2627; 5.1.0 before 5.1.3.2578; 4.5.4.2627; 5.1.3.2578 |
| CVE-2023-45025 | 9.8 | Feb 2 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 4.5.4.1715; 4.5.4.1723; 4.5.4.1741; 4.5.4.1787; 4.5.4.1800; 4.5.4.1892; +15 more |
| CVE-2023-39303 | 9.8 | Feb 2 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +2 more |
| CVE-2023-23369 | 9.8 | Nov 3 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 4.3.6.0895; 4.3.6.0907; 4.3.6.0923; 4.3.6.0944; 4.3.6.0959; +34 more |
| CVE-2023-23368 | 9.8 | Nov 3 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.0.1; 5.0.1.2034; 5.0.1.2079; 5.0.1.2131; 5.0.1.2137; 5.0.1.2145; +17 more |
| CVE-2023-23363 | 9.8 | Sep 22 | A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system Affected: 4.3.3 before 4.3.3.2420; 4.3.4 before 4.3.4.245; 4.3.6 before 4.3.6.2441 |
| CVE-2022-27596 | 9.8 | Jan 30 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS Affected: 5.0.1 before 5.0.1.2234 |
| CVE-2021-28804 | 9.8 | Jul 1 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero Affected: through 4.5.1.1540 |
| CVE-2021-28802 | 9.8 | Jul 1 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero Affected: before 4.5.1.1540 |
| CVE-2021-28800 | 9.8 | Jun 24 | A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS Affected: before 4.3.3.1624; 4.3.4 before 4.3.6.1663 |
| CVE-2020-36195 | 9.8 | Apr 17 | An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on Affected: before 4.3.3; 4.3.4 before 4.3.6; 4.3.3; 4.3.3.0095; 4.3.3.0096; 4.3.3.0136; +34 more |
| CVE-2019-7198 | 9.8 | Dec 10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application Affected: before 4.4.3.1354; before 4.5.1.1456 |
| CVE-2019-7183 | 9.8 | Dec 5 | This improper link resolution vulnerability allows remote attackers to access system files Affected: 4.2.6; 4.3.3.0868; 4.3.3.0998; 4.3.4.0899; 4.3.4.1029; 4.3.6.0895; +19 more |
| CVE-2018-0730 | 9.8 | Dec 4 | This command injection vulnerability in File Station allows attackers to execute commands on the affected device Affected: 4.2.6; 4.3.3.0868; 4.3.3.0998; 4.3.4.0899; 4.3.4.1029; 4.3.6.0895; +19 more |
| CVE-2018-14749 | 9.8 | Nov 28 | Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified… Affected: 4.2.6; 4.3.3; 4.3.4; 4.3.5 |
| CVE-2018-14746 | 9.8 | Nov 28 | Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote… Affected: 4.2.6; 4.3.3; 4.3.4; 4.3.5 |
| CVE-2018-0712 | 9.8 | Jun 21 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote… Affected: 4.2.6; 4.3.3; through 4.3.4 |
| CVE-2017-17033 | 9.8 | Dec 21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17032 | 9.8 | Dec 21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17031 | 9.8 | Dec 21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17030 | 9.8 | Dec 21 | A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17029 | 9.8 | Dec 21 | A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17028 | 9.8 | Dec 21 | A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-17027 | 9.8 | Dec 21 | A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow… Affected: through 4.3.3.0378; 4.3.4.0358; 4.3.4.0370; 4.3.4.0372; 4.3.4.0374; 4.3.4.0387 |
| CVE-2017-10700 | 9.8 | Sep 19 | In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application Affected: 4.3.3.0229 |
| CVE-2017-13067 | 9.8 | Sep 14 | QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901 Affected: 4.2.0 through 4.2.6; 4.3.0 through 4.3.3.0299 |
| CVE-2017-6361 | 9.8 | Mar 23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors Affected: through 4.2.4 |
| CVE-2017-6360 | 9.8 | Mar 23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors Affected: through 4.2.4 |
| CVE-2017-6359 | 9.8 | Mar 23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors Affected: through 4.2.4 |
| CVE-2024-48859 | 9.1 | Dec 6 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +16 more |
| CVE-2018-19945 | 9.1 | Dec 31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6 Affected: 4.3.4 before 4.3.4.0899; 4.3.5 before 4.3.6.0895 |
| CVE-2025-30264 | 8.8 | Aug 29 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-22481 | 8.8 | Jun 6 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +5 more |
| CVE-2024-53691 | 8.8 | Dec 6 | A link following vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +10 more |
| CVE-2024-50397 | 8.8 | Nov 22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +1 more |
| CVE-2024-50396 | 8.8 | Nov 22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +1 more |