- Top reward
- $20,000
- Top severity paid
- Not published
- Assets in scope
- 41
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays up to $20,000
- top reward.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 7 days
- As the policy promises.
- Payment
- No identity check to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$20,000
For confirmed security reports that pass the severity review, QNAP may offer a bounty of up to US$20,000.
- Response
-
Within 7 days
the researcher will, in principle, receive a QNAP PSIRT vulnerability confirmation email within one week after the information is confirmed complete
- Safe harbor
-
Full
If a researcher tests and reports in good faith in accordance with this page and the QNAP Security Bounty Program Terms and Conditions , QNAP will not take legal action against the researcher for such research activities.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
41 assets you may test, 41 excluded.
Domains 8
- account.qnap.com
- amizcloud.qnap.com
- license.qnap.com
- myqnapcloud.com
- organization.qnap.com
- quwan.qnap.com
- www.myqnapcloud.com
- www.myqnapcloud.com (excluding user-registered subdomains)
Wildcard domains 5
- account.qnap.com (including subdomains)
- amizcloud.qnap.com (including subdomains)
- license.qnap.com (including subdomains)
- organization.qnap.com (including subdomains)
- quwan.qnap.com (including subdomains)
Desktop and binaries 2
- Operating Systems
- QTS (5.2.0 and later official releases, excluding beta versions)
Products and areas 26
- Container Station
- HBS 3 Hybrid Backup Sync
- Helpdesk
- License Center
- Malware Remover
- Media Streaming add-on
- Multimedia Console
- myQNAPcloud Link
- Network & Virtual Switch
- Notification Center
- Official QNAP applications
- Qboost
- Qsync Central
- QTS 5.2.0 and later
- QTS 5.2.0 and later official releases
- QTS SSL Certificate
- QuFirewall
- QuLog Center
- QuMagie
- QuTScloud c5.1.0 and later
- QuTS hero h5.2.0 and later
- QuTS hero h5.2.0 and later official releases
- QVPN Service
- Resource Monitor
- Video Station
- Virtualization Station
Out of scope (41)
- Qsirch Mobile Android
- Qsync Pro Mobile Android
- qnap.com
- Photo Tagger Mobile iOS
- Qsirch Mobile iOS
- Qsync Pro Mobile iOS
- Applications maintained by third parties
- Applications provided through third-party app repositories
- Download Station
- Facebook for HD
- IFTTT Agent
- JRE
- MariaDB 5 / 10
- Mattermost
- MinimServer
- Mustang
- Mustang Card Manager
- Mustang - F100 Driver
- Mustang - V100 Driver (Mustang Card User Driver)
- Notes Station 3
- Notes Station 3 Clipper
- PHP Extensions
- phpMyAdmin
- PPPoE
- Python 2
- Python3
- QcalAgent
- Qget (Android and iOS)
- Qnotes 3 Mobile Android
- Qnotes 3 Mobile iOS
- QUSBCam2
- QuTScloud
- QuWAN Agent
- QuWAN vRouter
- Spotify for HD
- third-party software (e.g., third-party QPKGs)
- user-registered domains (e.g., myqnapcloud.com subdomains)
- VJBOD Cloud
- WirelessAP Station
- WordPress
- *.myqnapcloud.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from QNAP's policy.
While testing
-
Please encrypt your email using the PGP public key below and send it to [email protected] .
-
You must be the first researcher to report the vulnerability.
-
You have not publicly disclosed the vulnerability.
-
Please submit each independent issue in a separate report. Do not combine multiple unrelated issues into the same report.
-
A valid report for operating systems and applications must be verified on an actual QNAP device
-
Do not attach raw data files to your report.
-
within 7 calendar days of submitting the report, delete all relevant data and copies
-
Providing a written deletion statement is a prerequisite for receiving a reward.
-
Any action that may harm QNAP servers or data is strictly prohibited, and all security testing must comply with applicable laws.
-
Obtaining data beyond what is necessary to prove the exploitability of the issue (e.g., bulk exports, downloading complete datasets, large-scale enumeration across accounts or tenants)
Not accepted
-
DoS (denial-of-service) attacks against QNAP or user servers
-
Security testing that is harmful to QNAP or user servers or data
-
Physical attacks or social engineering
-
Disclosing vulnerability information before QNAP approves
-
Security issues rated as low severity in products and services that have reached end of life (EOL)
-
Applications maintained by third parties
-
Applications provided through third-party app repositories
-
Vulnerabilities introduced by third-party libraries
-
Security issues that only affect outdated web browsers
-
Most types of brute-force attacks
-
Security issues involving phishing, creating fake websites, or fraudulent activities
-
Vulnerability scan reports that do not detail the impact of the security issue
-
Reports of disclosed or undisclosed vulnerabilities in open-source software
-
Security issues in user-registered domains (e.g., myqnapcloud.com subdomains)
-
Theoretical issues based solely on inference without any actual execution results
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− https://www.qnap.com/go/security-bounty-program, − Cloud Services, − Applications officially developed by QNAP
-
Reward terms
+ Applications officially developed by QNAP
-
Reward raised
Maximum no amount → no amount
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-44084 | An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | High 8.7 | 15 Oct 2026 |
| CVE-2026-34015 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | High 8.7 | 15 Oct 2026 |
| CVE-2026-26244 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | High 7.1 | 15 Oct 2026 |
| CVE-2026-26245 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later | High 7.1 | 15 Oct 2026 |
| CVE-2026-24721 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Medium 5.3 | 15 Oct 2026 |
| CVE-2026-24722 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Medium 5.3 | 15 Oct 2026 |
| CVE-2026-24723 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Medium 5.3 | 15 Oct 2026 |
| CVE-2025-66272 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later | High 7.7 | 15 Oct 2026 |
| CVE-2025-66275 | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later | High 7.7 | 15 Oct 2026 |
| CVE-2026-26240 | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Low 1.3 | 10 Jun 2026 |
| CVE-2026-26241 | A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Low 1.3 | 10 Jun 2026 |
| CVE-2026-26239 | A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later | Medium 6.3 | 10 Jun 2026 |
| CVE-2026-26237 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later | Medium 6.6 | 10 Jun 2026 |
| CVE-2026-24716 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later | Low 1.2 | 10 Jun 2026 |
| CVE-2026-24717 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and lat | Low 1.2 | 10 Jun 2026 |
| CVE-2026-24719 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later | Medium 6.1 | 10 Jun 2026 |
| CVE-2026-24720 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Low 1.3 | 10 Jun 2026 |
| CVE-2026-24724 | An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later | Medium 6.2 | 10 Jun 2026 |
| CVE-2026-22899 | A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later | Low 1.3 | 10 Jun 2026 |
| CVE-2026-22893 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.350 | High 8.6 | 10 Jun 2026 |
| CVE-2025-66281 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 | Medium 6.9 | 10 Jun 2026 |
| CVE-2025-62851 | A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: License Center 1.9.56 and later | Medium 4.6 | 10 Jun 2026 |
| CVE-2025-66273 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.350 | High 8.6 | 10 Jun 2026 |
| CVE-2025-66279 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.350 | High 8.6 | 10 Jun 2026 |
| CVE-2025-66280 | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and l | Medium 5.1 | 10 Jun 2026 |
| CVE-2025-62850 | A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QTS 5.2.9.3410 build 20260214 and later QVP 2.7.4 and later QuTS cloud c5.2.9.3468 build 202 | Medium 5.1 | 10 Jun 2026 |
| CVE-2025-66276 | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later | Critical 9.2 | 10 Jun 2026 |
| CVE-2025-58468 | A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: Notification Center 1.10.0.3291 and later | Medium 5.1 | 10 Jun 2026 |
| CVE-2026-44083 | An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later | High 8.7 | 9 Jun 2026 |
| CVE-2025-62858 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4 | Medium 5.1 | 9 Jun 2026 |
| CVE-2026-41539 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 b | Medium 6.3 | 9 Jun 2026 |
| CVE-2026-26236 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later | Medium 6.6 | 9 Jun 2026 |
| CVE-2026-22901 | A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later | Medium 6.3 | 20 Mar 2026 |
| CVE-2026-22902 | A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later | Medium 5.7 | 20 Mar 2026 |
| CVE-2026-22895 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuFTP Service 1.4.3 and later QuFTP Service 1.5.2 and later QuFTP Service 1.6.2 and later | Medium 6.2 | 20 Mar 2026 |
| CVE-2026-22897 | A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later | High 8.1 | 20 Mar 2026 |
| CVE-2026-22898 | A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later | Critical 9.3 | 20 Mar 2026 |
| CVE-2026-22900 | A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later | Medium 6.8 | 20 Mar 2026 |
| CVE-2025-62845 | An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later | Medium 5.6 | 20 Mar 2026 |
| CVE-2025-62846 | An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later | High 7.3 | 20 Mar 2026 |
| CVE-2025-59383 | A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming Add-on 500.1.1 and later | Low 2.7 | 20 Mar 2026 |
| CVE-2025-62843 | An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended for the original endpoint. We have already fixed the vulnerability in the following version: QuRouter 2.6.3.009 and later | Low 0.9 | 20 Mar 2026 |
| CVE-2025-62844 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later | Medium 4.0 | 20 Mar 2026 |
| CVE-2025-59388 | A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: Hyper Data Protector 2.3.1.455 and later | Medium 6.6 | 12 Mar 2026 |
| CVE-2024-14025 | An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later | Low 0.1 | 11 Mar 2026 |
| CVE-2024-14026 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.3.3006 build 20250108 and later Q | Low 2.0 | 11 Mar 2026 |
| CVE-2024-14024 | An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later | Low 0.1 | 11 Mar 2026 |
| CVE-2025-66278 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-68406 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later | Low 1.3 | 11 Feb 2026 |
| CVE-2026-22894 | A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-59386 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: QuTS hero h5.3.2.3354 build 20251225 and later | Low 1.2 | 11 Feb 2026 |
| CVE-2025-62853 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5166 and later | Medium 5.2 | 11 Feb 2026 |
| CVE-2025-62854 | An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-62855 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-62856 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-66274 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later | Medium 5.1 | 11 Feb 2026 |
| CVE-2025-66277 | A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 a | Critical 9.2 | 11 Feb 2026 |
| CVE-2025-58470 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later | Low 1.3 | 11 Feb 2026 |
| CVE-2025-58471 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.2.0.1 ( 2025/12/2 | Low 1.2 | 11 Feb 2026 |
| CVE-2025-58472 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later | Low 1.2 | 11 Feb 2026 |