Login Request a demo
DS
Product
Download Station
by QNAP Systems Inc. · last CVE Oct 15, 2026
6
CVEs
0
On KEV
8.7
Max CVSS
3
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 2Medium 4Low 0
Severity
All severities6Critical0High2Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Download Station to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-39993
8.7
0%
Oct 15
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
Affected: 5.10.x before 5.10.2.313; 5.11.x before 5.11.3.322
CVE-2026-34014
8.4
0%
Oct 15
ds-move-files.sh is writable and executed as root
Affected: 5.10.x before 5.10.1.312; 5.11.x before 5.11.2.321
Showing 2