QH
Product
Quts Hero
On CISA KEVExploited in the wild
234
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 15High 107Medium 109Low 3
Watch
Add Quts Hero to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-50359 | 6.7 | Feb 2 | An unchecked return value vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +3 more |
| CVE-2026-24717 | 6.5 | Jun 10 | QTS, QuTS hero Affected: h5.0.0 before h5.2.9.3499; h5.3.0.3115 before h5.3.4.3500; h6.0.0.3324 before h6.0.0.3459 |
| CVE-2025-62858 | 6.5 | Jun 9 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +23 more |
| CVE-2025-62852 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +14 more |
| CVE-2025-48721 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +14 more |
| CVE-2025-53593 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-53592 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-53591 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-47208 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-44013 | 6.5 | Jan 2 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +12 more |
| CVE-2025-53407 | 6.5 | Oct 3 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +8 more |
| CVE-2025-53406 | 6.5 | Oct 3 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +8 more |
| CVE-2025-52429 | 6.5 | Oct 3 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +8 more |
| CVE-2025-48730 | 6.5 | Oct 3 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +8 more |
| CVE-2025-30274 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30272 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30271 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30270 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30268 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30267 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-30265 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2025-29882 | 6.5 | Aug 29 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +7 more |
| CVE-2024-37050 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +1 more |
| CVE-2024-37049 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +1 more |
| CVE-2024-37047 | 6.5 | Nov 22 | A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +1 more |
| CVE-2024-21904 | 6.5 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +5 more |
| CVE-2023-51368 | 6.5 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2023-51366 | 6.5 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2024-21900 | 6.5 | Mar 8 | An injection vulnerability has been reported to affect several QNAP operating system versions Affected: before h5.1.3.2578; h5.1.3.2578 |
| CVE-2023-34972 | 6.5 | Aug 24 | A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems Affected: h5.1.0 before h5.1.0.2424 |
| CVE-2026-41539 | 6.1 | Jun 9 | QTS, QuTS hero Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +27 more |
| CVE-2023-23372 | 6.1 | Dec 8 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.0.1.2045; h5.0.1.2192; h5.0.1.2248; h5.0.1.2269; h5.0.1.2277; +15 more |
| CVE-2021-44054 | 6.1 | May 5 | An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS Affected: before h4.5.4.1771; h5.0.0.1772 before h5.0.0.1986 |
| CVE-2021-44053 | 6.1 | May 5 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud Affected: before h4.5.4.1771; h5.0.0.1772 before h5.0.0.1986 |
| CVE-2021-38674 | 6.1 | Jan 7 | A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud Affected: before h4.5.4.1771 |
| CVE-2018-19957 | 6.1 | Sep 10 | A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud Affected: before h4.5.4.1771 |
| CVE-2020-36194 | 6.1 | Jul 1 | An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero Affected: before h4.5.2.1638 |
| CVE-2018-19942 | 6.1 | Apr 16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station Affected: before h4.5.1; h4.5.1; h4.5.1 |
| CVE-2020-2498 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration Affected: before h4.5.1.1472 |
| CVE-2020-2497 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs Affected: before 4.5.1.1472 |
| CVE-2020-2496 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1472 |
| CVE-2020-2495 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1472 |
| CVE-2023-50358 | 5.8 | Feb 13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: h4.5.0 before h4.5.4.2626; h5.0.0 before h5.1.5.2647; h4.5.4.2626; h5.1.5.2647 |
| CVE-2024-50405 | 5.5 | Mar 7 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +4 more |
| CVE-2024-56805 | 5.4 | Jun 6 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: h5.2.0.2737; h5.2.0.2782; h5.2.0.2789; h5.2.0.2802; h5.2.0.2823; h5.2.0.2851; +6 more |
| CVE-2024-21897 | 5.4 | Sep 6 | QTS, QuTS hero Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +4 more |
| CVE-2021-28806 | 5.4 | Jun 3 | A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero Affected: before h4.5.2.1638 |
| CVE-2024-48866 | 5.3 | Dec 6 | An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions Affected: h5.1.0.2409; h5.1.0.2424; h5.1.0.2453; h5.1.0.2466; h5.1.1.2488; h5.1.2.2534; +18 more |
| CVE-2023-34973 | 5.3 | Aug 24 | An insufficient entropy vulnerability has been reported to affect QNAP operating systems Affected: h5.1.0 before h5.1.0.2424 |
| CVE-2021-38693 | 5.3 | May 5 | A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance Affected: h5.0.0.1772 before h5.0.0.1949 |