QT
Product
QTS
On CISA KEVExploited in the wildRansomware-linked
283
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 43High 115Medium 120Low 3
Watch
Add QTS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-19953 RansomwareIn wildKEV | 6.1 | Oct 28 | QNAP NAS File Station Cross-Site Scripting Vulnerability Affected: before 4.2.6; 4.3.1.0013 before 4.3.3.1161; 4.3.4 before 4.3.4.1190; 4.3.6 before 4.3.6.1218; 4.4.0 before 4.4.1.1201; 4.4.2 before 4.4.2.1231; +6 more |
| CVE-2018-19943 RansomwareIn wildKEV | 5.4 | Oct 28 | QNAP NAS File Station Cross-Site Scripting Vulnerability Affected: before 4.2.6; 4.3.1.0013 before 4.3.3.1252; 4.3.4 before 4.3.4.1282; 4.3.6 before 4.3.6.1263; 4.4.0 before 4.4.1.1261; 4.4.2 before 4.4.2.1270; +10 more |
| CVE-2023-50359 | 6.7 | Feb 2 | An unchecked return value vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +4 more |
| CVE-2026-24717 | 6.5 | Jun 10 | QTS, QuTS hero Affected: 5.2.0.2737 before 5.2.9.3492 |
| CVE-2025-62858 | 6.5 | Jun 9 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +15 more |
| CVE-2025-62852 | 6.5 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +12 more |
| CVE-2025-48721 | 6.5 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +12 more |
| CVE-2025-53593 | 6.5 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53592 | 6.5 | Jan 2 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53591 | 6.5 | Jan 2 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-47208 | 6.5 | Jan 2 | An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-44013 | 6.5 | Jan 2 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53407 | 6.5 | Oct 3 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-53406 | 6.5 | Oct 3 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52429 | 6.5 | Oct 3 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-48730 | 6.5 | Oct 3 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-30274 | 6.5 | Aug 29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30272 | 6.5 | Aug 29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30271 | 6.5 | Aug 29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30270 | 6.5 | Aug 29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30268 | 6.5 | Aug 29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30267 | 6.5 | Aug 29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-30265 | 6.5 | Aug 29 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2025-29882 | 6.5 | Aug 29 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +7 more |
| CVE-2024-37050 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +1 more |
| CVE-2024-37049 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +1 more |
| CVE-2024-37047 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +1 more |
| CVE-2024-21904 | 6.5 | Sep 6 | QTS, QuTS hero Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +6 more |
| CVE-2023-51368 | 6.5 | Sep 6 | QTS, QuTS hero Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +5 more |
| CVE-2023-51366 | 6.5 | Sep 6 | QTS, QuTS hero Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +5 more |
| CVE-2024-21900 | 6.5 | Mar 8 | An injection vulnerability has been reported to affect several QNAP operating system versions Affected: before 5.1.3.2578; 5.1.3.2578 |
| CVE-2023-32967 | 6.5 | Feb 2 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions Affected: 4.5.4.1715; 4.5.4.1723; 4.5.4.1741; 4.5.4.1787; 4.5.4.1800; 4.5.4.1892; +6 more |
| CVE-2023-34972 | 6.5 | Aug 24 | A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems Affected: 5.0.1 before 5.0.1.2425; 5.1.0 before 5.1.0.2444 |
| CVE-2026-41539 | 6.1 | Jun 9 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +17 more |
| CVE-2023-23372 | 6.1 | Dec 8 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.0.1.2034; 5.0.1.2079; 5.0.1.2131; +20 more |
| CVE-2021-44054 | 6.1 | May 5 | An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS Affected: 5.0.0.1716 before 5.0.0.1986 |
| CVE-2021-44053 | 6.1 | May 5 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud Affected: 5.0.0.1716 before 5.0.0.1986 |
| CVE-2021-38674 | 6.1 | Jan 7 | A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud Affected: before 4.5.4.1787 |
| CVE-2018-19957 | 6.1 | Sep 10 | A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud Affected: before 4.5.4.1715 |
| CVE-2020-36194 | 6.1 | Jul 1 | An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero Affected: before 4.5.2.1566 |
| CVE-2018-19942 | 6.1 | Apr 16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station Affected: before 4.2.6; 4.3.5 before 4.3.6; 4.4.0 before 4.5.1; 4.2.6; 4.2.6; 4.2.6; +34 more |
| CVE-2020-2498 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration Affected: before 4.5.1.1456 |
| CVE-2020-2497 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2020-2496 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2020-2495 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2018-0716 | 6.1 | Nov 30 | Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions… Affected: 4.2.6; 4.3.3; 4.3.4; 4.3.5 |
| CVE-2017-13072 | 6.1 | Jun 21 | Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow… Affected: 4.2.6; 4.3.3; 4.3.4 |
| CVE-2018-0711 | 6.1 | Apr 30 | Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary… Affected: 4.3.3.0514; 4.3.3.0546; 4.3.3.0570; 4.3.4.0516; 4.3.4.0526; 4.3.4.0551; +6 more |
| CVE-2017-7632 | 6.1 | Mar 27 | Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web… Affected: 4.2.6; 4.3.3 |
| CVE-2017-7631 | 6.1 | Mar 27 | Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to… Affected: 4.2.6; 4.3.3 |