Programs
Companies
QNAP

QNAP bug bounty programs

qnap.com Updated 12 Nov 2026

QNAP runs one public program: a self-hosted bug bounty paying up to $20,000.

Top reward: $20,000; Self-hosted
Programs: 1; 1 pays cash
Targets in scope: 41; 4 types
Last change: None yet; Tracked since Nov 2026

Where to report

The one public program QNAP runs.

QNAP programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.
Program	Top reward	Safe harbor	KYC	First response	Status
QNAP Self-hosted · Bug bounty	$20,000	Full	Not required	7 days promised	Open

QNAP
Self-hosted · Bug bounty

Open

Top reward
$20k

Safe harbor

Full

KYC

Not required

First response

7 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

41 targets. 41 excluded.

account.qnap.com (including subdomains)

Wildcards
amizcloud.qnap.com (including subdomains)

Wildcards
license.qnap.com (including subdomains)

Wildcards
organization.qnap.com (including subdomains)

Wildcards
quwan.qnap.com (including subdomains)

Wildcards
account.qnap.com

Domains
amizcloud.qnap.com

Domains
license.qnap.com

Domains
myqnapcloud.com

Domains
organization.qnap.com

Domains
quwan.qnap.com

Domains
www.myqnapcloud.com

Domains
www.myqnapcloud.com (excluding user-registered subdomains)

Domains
Operating Systems

Desktop and binaries
QTS (5.2.0 and later official releases, excluding beta versions)

Desktop and binaries
Container Station

Products and areas
HBS 3 Hybrid Backup Sync

Products and areas
Helpdesk

Products and areas
License Center

Products and areas
Malware Remover

Products and areas
Media Streaming add-on

Products and areas
Multimedia Console

Products and areas
myQNAPcloud Link

Products and areas
Network & Virtual Switch

Products and areas
Notification Center

Products and areas
Official QNAP applications

Products and areas
Qboost

Products and areas
Qsync Central

Products and areas
QTS 5.2.0 and later

Products and areas
QTS 5.2.0 and later official releases

Products and areas
QTS SSL Certificate

Products and areas
QuFirewall

Products and areas
QuLog Center

Products and areas
QuMagie

Products and areas
QuTS hero h5.2.0 and later

Products and areas
QuTS hero h5.2.0 and later official releases

Products and areas
QuTScloud c5.1.0 and later

Products and areas
QVPN Service

Products and areas
Resource Monitor

Products and areas
Video Station

Products and areas
Virtualization Station

Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 41

Don't test these. A program can exclude a host another program covers; the program you report to decides.

*.myqnapcloud.com
qnap.com
Qsirch Mobile Android
Qsync Pro Mobile Android
Photo Tagger Mobile iOS
Qsirch Mobile iOS
Qsync Pro Mobile iOS
Applications maintained by third parties
Applications provided through third-party app repositories
Download Station
Facebook for HD
IFTTT Agent
JRE
MariaDB 5 / 10
Mattermost
MinimServer
Mustang
Mustang - F100 Driver
Mustang - V100 Driver (Mustang Card User Driver)
Mustang Card Manager
Notes Station 3
Notes Station 3 Clipper
PHP Extensions
phpMyAdmin
PPPoE
Python 2
Python3
QcalAgent
Qget (Android and iOS)
Qnotes 3 Mobile Android
Qnotes 3 Mobile iOS
QUSBCam2
QuTScloud
QuWAN Agent
QuWAN vRouter
Spotify for HD
third-party software (e.g., third-party QPKGs)
user-registered domains (e.g., myqnapcloud.com subdomains)
VJBOD Cloud
WirelessAP Station
WordPress

Recent changes

Reward and scope changes across every QNAP program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in QNAP products, from the NVD.

Search NVD

CVE-2026-44084 High

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-34015 High

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26244 High

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26245 High

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-24721 Medium

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2026-24722 Medium

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2026-24723 Medium

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2025-66272 High

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later

About this page

This page gathers every public program listed under qnap.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.