QH
Product
Quts Hero
On CISA KEVExploited in the wild
234
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 15High 107Medium 109Low 3
Watch
Add Quts Hero to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-2509 In wildKEV | 9.8 | Apr 17 | Command Injection Vulnerability in QTS and QuTS hero Affected: before h4.5.1; h4.5.1; h4.5.1.1472 |
| CVE-2024-32766 | 10.0 | Apr 26 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.0 before h4.5.4.2626; h5.0.0 before h5.1.3.2578; h4.5.4.2626; h5.1.3.2578 |
| CVE-2025-66277 | 9.8 | Feb 11 | A link following vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-62849 | 9.8 | Dec 16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +14 more |
| CVE-2025-59385 | 9.8 | Dec 16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +14 more |
| CVE-2024-50393 | 9.8 | Dec 6 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +18 more |
| CVE-2024-21899 | 9.8 | Mar 8 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: before h4.5.4.2626; h5.1.0 before h5.1.3.2578; h4.5.4.2626; h5.1.3.2578 |
| CVE-2023-45025 | 9.8 | Feb 2 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.4.1771; h4.5.4.1800; h4.5.4.1813; h4.5.4.1848; h4.5.4.1892; h4.5.4.1951; +17 more |
| CVE-2023-39303 | 9.8 | Feb 2 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +1 more |
| CVE-2023-23368 | 9.8 | Nov 3 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.0.1.2045; h5.0.1.2192; h5.0.1.2248; h5.0.1.2269; h5.0.1.2277; h5.0.1.2348; +12 more |
| CVE-2022-27596 | 9.8 | Jan 30 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS Affected: h5.0.1 before h5.0.1.2248 |
| CVE-2021-28804 | 9.8 | Jul 1 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero Affected: through h4.5.1.1582 |
| CVE-2021-28802 | 9.8 | Jul 1 | A command injection vulnerabilities have been reported to affect QTS and QuTS hero Affected: before h4.5.1.1582 |
| CVE-2019-7198 | 9.8 | Dec 10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application Affected: before h4.5.1.1472 |
| CVE-2024-48859 | 9.1 | Dec 6 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +18 more |
| CVE-2025-30264 | 8.8 | Aug 29 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-22481 | 8.8 | Jun 6 | A command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +6 more |
| CVE-2024-53691 | 8.8 | Dec 6 | A link following vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +11 more |
| CVE-2024-50397 | 8.8 | Nov 22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +1 more |
| CVE-2024-50396 | 8.8 | Nov 22 | A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +1 more |
| CVE-2024-32763 | 8.8 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +8 more |
| CVE-2023-34974 | 8.8 | Sep 6 | QTS, QuTS hero, QuTScloud, QVR, QES Affected: h4.5.4.1771; h4.5.4.1800; h4.5.4.1813; h4.5.4.1848; h4.5.4.1892; h4.5.4.1951; +9 more |
| CVE-2024-21898 | 8.8 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2023-51367 | 8.8 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2024-27130 | 8.8 | May 21 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2024-27129 | 8.8 | May 21 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2024-27128 | 8.8 | May 21 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2024-27127 | 8.8 | May 21 | A double free vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2023-50364 | 8.8 | Apr 26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2023-50362 | 8.8 | Apr 26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2023-50361 | 8.8 | Apr 26 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2023-47568 | 8.8 | Feb 2 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.4.1771; h4.5.4.1800; h4.5.4.1813; h4.5.4.1848; h4.5.4.1892; h4.5.4.1951; +18 more |
| CVE-2023-39297 | 8.8 | Feb 2 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.4.1771; h4.5.4.1800; h4.5.4.1813; h4.5.4.1848; h4.5.4.1892; h4.5.4.1951; +17 more |
| CVE-2023-23362 | 8.8 | Sep 22 | An OS command injection vulnerability has been reported to affect QNAP operating systems Affected: h4.5.4 before h4.5.4.2374; h5.0.1 before h5.0.1.2376 |
| CVE-2023-34971 | 8.8 | Aug 24 | An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems Affected: h4.5.4 before h4.5.4.2476; h5.1.0 before h5.1.0.2424 |
| CVE-2021-44051 | 8.8 | May 5 | A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS Affected: before h4.5.4.1771; h5.0.0.1772 before h5.0.0.1986 |
| CVE-2021-28816 | 8.8 | Sep 10 | A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero Affected: before h4.5.4.1771 |
| CVE-2020-25847 | 8.8 | Dec 29 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application Affected: before h4.5.1.1491 |
| CVE-2023-34980 | 8.4 | Mar 8 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.0 before h4.5.4.2626; h4.5.4.2626 |
| CVE-2023-47218 | 8.3 | Feb 13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0 before h5.1.5.2647; h5.1.5.2647 |
| CVE-2024-21905 | 8.2 | Apr 26 | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions Affected: h5.0.0 before h5.1.3.2578; h5.1.3.2578 |
| CVE-2025-48725 | 8.1 | Feb 11 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-52872 | 8.1 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-52864 | 8.1 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-52863 | 8.1 | Jan 2 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-30273 | 8.1 | Aug 29 | An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2024-21902 | 8.1 | May 21 | An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2023-50363 | 8.1 | Apr 26 | An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2021-44052 | 8.1 | May 5 | An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS Affected: before h4.5.4.1771; h5.0.0.1772 before h5.0.0.1986 |
| CVE-2024-14026 | 7.8 | Mar 11 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +19 more |