# cve.now: Q-free

The newest entries naming Q-free as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-26378](https://cve.now/CVE-2025-26378.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.8)
- [CVE-2025-26377](https://cve.now/CVE-2025-26377.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.1)
- [CVE-2025-26376](https://cve.now/CVE-2025-26376.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 6.5)
- [CVE-2025-26375](https://cve.now/CVE-2025-26375.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authentica (CVSS 8.8)
- [CVE-2025-26374](https://cve.now/CVE-2025-26374.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 all (CVSS 6.5)
- [CVE-2025-26373](https://cve.now/CVE-2025-26373.md): A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allo (CVSS 6.5)
- [CVE-2025-26372](https://cve.now/CVE-2025-26372.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 7.1)
- [CVE-2025-26371](https://cve.now/CVE-2025-26371.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.8)
- [CVE-2025-26370](https://cve.now/CVE-2025-26370.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 7.1)
- [CVE-2025-26369](https://cve.now/CVE-2025-26369.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.8)
- [CVE-2025-26368](https://cve.now/CVE-2025-26368.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 8.1)
- [CVE-2025-26367](https://cve.now/CVE-2025-26367.md): A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an auth (CVSS 4.3)
- [CVE-2025-26366](https://cve.now/CVE-2025-26366.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5)
- [CVE-2025-26365](https://cve.now/CVE-2025-26365.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5)
- [CVE-2025-26364](https://cve.now/CVE-2025-26364.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5)
- [CVE-2025-26363](https://cve.now/CVE-2025-26363.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5)
- [CVE-2025-26362](https://cve.now/CVE-2025-26362.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 7.5)
- [CVE-2025-26361](https://cve.now/CVE-2025-26361.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11 (CVSS 9.1)
- [CVE-2025-26360](https://cve.now/CVE-2025-26360.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to versio (CVSS 5.3)
- [CVE-2025-26359](https://cve.now/CVE-2025-26359.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8)
- [CVE-2025-26358](https://cve.now/CVE-2025-26358.md): A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an (CVSS 5.5)
- [CVE-2025-26357](https://cve.now/CVE-2025-26357.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate (CVSS 4.9)
- [CVE-2025-26356](https://cve.now/CVE-2025-26356.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 a (CVSS 7.2)
- [CVE-2025-26355](https://cve.now/CVE-2025-26355.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticate (CVSS 6.5)
- [CVE-2025-26354](https://cve.now/CVE-2025-26354.md): A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows (CVSS 7.2)
- [CVE-2025-26353](https://cve.now/CVE-2025-26353.md): A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote a (CVSS 4.9)
- [CVE-2025-26352](https://cve.now/CVE-2025-26352.md): A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (CVSS 6.5)
- [CVE-2025-26351](https://cve.now/CVE-2025-26351.md): A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (CVSS 4.9)
- [CVE-2025-26350](https://cve.now/CVE-2025-26350.md): A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.1 (CVSS 4.9)
- [CVE-2025-26349](https://cve.now/CVE-2025-26349.md): A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticat (CVSS 7.2)
- [CVE-2025-26348](https://cve.now/CVE-2025-26348.md): A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu e (CVSS 5.5)
- [CVE-2025-26347](https://cve.now/CVE-2025-26347.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11. (CVSS 9.8)
- [CVE-2025-26346](https://cve.now/CVE-2025-26346.md): A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupM (CVSS 5.5)
- [CVE-2025-26345](https://cve.now/CVE-2025-26345.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11. (CVSS 9.8)
- [CVE-2025-26344](https://cve.now/CVE-2025-26344.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version (CVSS 9.8)
- [CVE-2025-26343](https://cve.now/CVE-2025-26343.md): A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth (CVSS 8.1)
- [CVE-2025-26342](https://cve.now/CVE-2025-26342.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8)
- [CVE-2025-26341](https://cve.now/CVE-2025-26341.md): A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2 (CVSS 9.8)
- [CVE-2025-26340](https://cve.now/CVE-2025-26340.md): A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthen (CVSS 8.8)
- [CVE-2025-26339](https://cve.now/CVE-2025-26339.md): A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 a (CVSS 9.8)
- [CVE-2025-1102](https://cve.now/CVE-2025-1102.md): A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat (CVSS 5.5)
- [CVE-2025-1101](https://cve.now/CVE-2025-1101.md): A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat (CVSS 5.3)
- [CVE-2025-1100](https://cve.now/CVE-2025-1100.md): A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/q-free
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.