# cve.now: QNAP Systems

The newest entries naming QNAP Systems as an affected vendor (up to 200), of 595 in all, 8 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-62841](https://cve.now/CVE-2025-62841.md): Hard-coded Cryptographic Key #2 (CVSS 8.7)
- [CVE-2025-62839](https://cve.now/CVE-2025-62839.md): Hard-coded Cryptographic Key #1 (CVSS 8.7)
- [CVE-2026-50619](https://cve.now/CVE-2026-50619.md): Unauthenticated remote code execution vulnerability (CVSS 9.3)
- [CVE-2026-47790](https://cve.now/CVE-2026-47790.md): Privilege Escalation via QuFTP Log-based XSS (CVSS 6.3)
- [CVE-2026-47786](https://cve.now/CVE-2026-47786.md): Pre-Authentication Command Injection (CVSS 9.3)
- [CVE-2026-39997](https://cve.now/CVE-2026-39997.md): Unauthenticated Remote Input Injection in QNAP HD Station's remotepad (CVSS 8.9)
- [CVE-2026-39991](https://cve.now/CVE-2026-39991.md): Stored Cross-Site Scripting (XSS) in Note Station file upload functionality (CVSS 4.8)
- [CVE-2026-34009](https://cve.now/CVE-2026-34009.md): \*\*Container Escape\*\* Host user home directory mounted with write access into application container (CVSS 8.4)
- [CVE-2026-34008](https://cve.now/CVE-2026-34008.md): \*\*Privilege Escalation\*\* World-writable crontab path monitored and executed by root-owned process (CVSS 8.5)
- [CVE-2026-34007](https://cve.now/CVE-2026-34007.md): \*\*RCE\*\* Unsanitized \`X-Forwarded-For\` header passed to \`shell\_exec()\` via broken IP validation fallback in \`getClientIP()\` (CVSS 6.9)
- [CVE-2026-53882](https://cve.now/CVE-2026-53882.md): Path Traversal in Virtualization Station VM Import (CVSS 8.7)
- [CVE-2026-50612](https://cve.now/CVE-2026-50612.md): Import Symlink Following Remote Code Execution Vulnerability in QuMagie (CVSS 9.4)
- [CVE-2026-44084](https://cve.now/CVE-2026-44084.md): Access Code Forgery in Video Station leading to unauthorized media access (CVSS 8.7)
- [CVE-2026-41545](https://cve.now/CVE-2026-41545.md): WebSocket timelapse path traversal and command injection (CVSS 8.6)
- [CVE-2026-41541](https://cve.now/CVE-2026-41541.md): Symlink creation in qsyncsrv.cgi (CVSS 5.3)
- [CVE-2026-39989](https://cve.now/CVE-2026-39989.md): SSRF in QNAP Download Station (CVSS 5.3)
- [CVE-2026-34015](https://cve.now/CVE-2026-34015.md): Remote Code Execution in upload.php of Video Station (CVSS 8.7)
- [CVE-2026-34014](https://cve.now/CVE-2026-34014.md): ds-move-files.sh is writable and executed as root (CVSS 8.4)
- [CVE-2026-34006](https://cve.now/CVE-2026-34006.md): Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer (CVSS 9.3)
- [CVE-2026-26245](https://cve.now/CVE-2026-26245.md): SQLi#2 SQL Injection in class\_videos.php getSmartVideosByOffset (CVSS 7.1)
- [CVE-2026-26244](https://cve.now/CVE-2026-26244.md): SQLi#1 SQL Injection in class\_videos.php \_getFilters (CVSS 7.1)
- [CVE-2026-26243](https://cve.now/CVE-2026-26243.md): Arbitrary Folder Deletion in Qsync Central 5.0.0.5 (CVSS 7.2)
- [CVE-2026-41544](https://cve.now/CVE-2026-41544.md): Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint (CVSS 8.7)
- [CVE-2026-39993](https://cve.now/CVE-2026-39993.md): Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter (CVSS 8.7)
- [CVE-2026-24723](https://cve.now/CVE-2026-24723.md): NULL Pointer Dereference in utilRequest.cgi (CVSS 5.3)
- [CVE-2026-24722](https://cve.now/CVE-2026-24722.md): Null Pointer Dereference in File Station 5 (CVSS 5.3)
- [CVE-2026-24721](https://cve.now/CVE-2026-24721.md): Null Pointer Dereference in File Station 5 (CVSS 5.3)
- [CVE-2026-24718](https://cve.now/CVE-2026-24718.md): Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi (CVSS 5.3)
- [CVE-2026-24715](https://cve.now/CVE-2026-24715.md): Lack of Reproducible Vulnerability Evidence in QNAP Report (CVSS 5.3)
- [CVE-2026-22896](https://cve.now/CVE-2026-22896.md): Stored XSS via Interface Name in Network & Virtual Switch App (CVSS 6.2)
- [CVE-2025-68404](https://cve.now/CVE-2025-68404.md): vcs\_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface (CVSS 7.5)
- [CVE-2025-68403](https://cve.now/CVE-2025-68403.md): Inadequate Steps to Confirm Vulnerability in QuRouter (CVSS 4.6)
- [CVE-2025-66275](https://cve.now/CVE-2025-66275.md): Remote code execution via command injection (CVSS 7.7)
- [CVE-2025-66272](https://cve.now/CVE-2025-66272.md): Arbitrary file deletion and remote code execution (CVSS 7.7)
- [CVE-2025-29897](https://cve.now/CVE-2025-29897.md): Stack-based Buffer Overflow in qsyncsrv.cgi (CVSS 2.3)
- [CVE-2025-29896](https://cve.now/CVE-2025-29896.md): NULL Pointer Dereference in qsyncsrv.cgi (CVSS 2.3)
- [CVE-2025-29895](https://cve.now/CVE-2025-29895.md): NULL Pointer Dereference in qsyncsrv.cgi (CVSS 2.3)
- [CVE-2024-38639](https://cve.now/CVE-2024-38639.md): QTS (CVSS 4.8)
- [CVE-2024-27123](https://cve.now/CVE-2024-27123.md): QcalAgent (CVSS 5.2)
- [CVE-2026-26240](https://cve.now/CVE-2026-26240.md): File Station 5 (CVSS 1.3)
- [CVE-2026-26241](https://cve.now/CVE-2026-26241.md): File Station 5 (CVSS 1.3)
- [CVE-2026-24724](https://cve.now/CVE-2026-24724.md): File Station 5 (CVSS 6.2)
- [CVE-2026-26239](https://cve.now/CVE-2026-26239.md): File Station 5 (CVSS 6.3)
- [CVE-2026-26237](https://cve.now/CVE-2026-26237.md): QuMagie (CVSS 6.6)
- [CVE-2026-24719](https://cve.now/CVE-2026-24719.md): QTS, QuTS hero (CVSS 6.1)
- [CVE-2026-24717](https://cve.now/CVE-2026-24717.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2026-24716](https://cve.now/CVE-2026-24716.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2026-24720](https://cve.now/CVE-2026-24720.md): File Station 5 (CVSS 1.3)
- [CVE-2026-22899](https://cve.now/CVE-2026-22899.md): File Station 5 (CVSS 1.3)
- [CVE-2026-22893](https://cve.now/CVE-2026-22893.md): QTS, QuTS hero (CVSS 8.6)
- [CVE-2025-66281](https://cve.now/CVE-2025-66281.md): QTS, QuTS hero (CVSS 6.9)
- [CVE-2025-66280](https://cve.now/CVE-2025-66280.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-66279](https://cve.now/CVE-2025-66279.md): QTS, QuTS hero (CVSS 8.6)
- [CVE-2025-66273](https://cve.now/CVE-2025-66273.md): QTS, QuTS hero (CVSS 8.6)
- [CVE-2025-62851](https://cve.now/CVE-2025-62851.md): License Center (CVSS 4.6)
- [CVE-2025-62850](https://cve.now/CVE-2025-62850.md): NULL Pointer Dereference in networkRequest.cgi (CVSS 5.1)
- [CVE-2025-58468](https://cve.now/CVE-2025-58468.md): Notification Center (CVSS 5.1)
- [CVE-2025-59382](https://cve.now/CVE-2025-59382.md): QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) (CVSS 1.2)
- [CVE-2025-66276](https://cve.now/CVE-2025-66276.md): QTS (CVSS 9.2)
- [CVE-2026-44083](https://cve.now/CVE-2026-44083.md): QuMagie (CVSS 8.7)
- [CVE-2025-62858](https://cve.now/CVE-2025-62858.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2026-41539](https://cve.now/CVE-2026-41539.md): QTS, QuTS hero (CVSS 6.3)
- [CVE-2026-26236](https://cve.now/CVE-2026-26236.md): QuMagie (CVSS 6.6)
- [CVE-2025-59383](https://cve.now/CVE-2025-59383.md): Media Streaming Add-on (CVSS 2.7)
- [CVE-2025-62843](https://cve.now/CVE-2025-62843.md): QuRouter (CVSS 0.9)
- [CVE-2025-62844](https://cve.now/CVE-2025-62844.md): QuRouter (CVSS 4.0)
- [CVE-2025-62845](https://cve.now/CVE-2025-62845.md): QuRouter (CVSS 5.6)
- [CVE-2025-62846](https://cve.now/CVE-2025-62846.md): QuRouter (CVSS 7.3)
- [CVE-2026-22895](https://cve.now/CVE-2026-22895.md): QuFTP Service (CVSS 6.2)
- [CVE-2026-22897](https://cve.now/CVE-2026-22897.md): QuNetSwitch (CVSS 8.1)
- [CVE-2026-22898](https://cve.now/CVE-2026-22898.md): QVR Pro (CVSS 9.3)
- [CVE-2026-22900](https://cve.now/CVE-2026-22900.md): QuNetSwitch (CVSS 6.8)
- [CVE-2026-22901](https://cve.now/CVE-2026-22901.md): QuNetSwitch (CVSS 6.3)
- [CVE-2026-22902](https://cve.now/CVE-2026-22902.md): QuNetSwitch (CVSS 5.7)
- [CVE-2025-59388](https://cve.now/CVE-2025-59388.md): Hyper Data Protector (CVSS 6.6)
- [CVE-2024-14026](https://cve.now/CVE-2024-14026.md): QTS, QuTS hero (CVSS 2.0)
- [CVE-2024-14025](https://cve.now/CVE-2024-14025.md): Video Station (CVSS 0.1)
- [CVE-2024-14024](https://cve.now/CVE-2024-14024.md): Video Station (CVSS 0.1)
- [CVE-2024-56807](https://cve.now/CVE-2024-56807.md): Media Streaming add-on (CVSS 1.7)
- [CVE-2024-56808](https://cve.now/CVE-2024-56808.md): Media Streaming add-on (CVSS 2.0)
- [CVE-2025-30266](https://cve.now/CVE-2025-30266.md): Qsync Central (CVSS 0.6)
- [CVE-2025-30269](https://cve.now/CVE-2025-30269.md): Qsync Central (CVSS 0.6)
- [CVE-2025-30276](https://cve.now/CVE-2025-30276.md): Qsync Central (CVSS 4.9)
- [CVE-2025-47205](https://cve.now/CVE-2025-47205.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-47209](https://cve.now/CVE-2025-47209.md): Qsync Central (CVSS 1.3)
- [CVE-2025-48722](https://cve.now/CVE-2025-48722.md): Qsync Central (CVSS 1.3)
- [CVE-2025-48723](https://cve.now/CVE-2025-48723.md): Qsync Central (CVSS 0.6)
- [CVE-2025-48724](https://cve.now/CVE-2025-48724.md): Qsync Central (CVSS 0.6)
- [CVE-2025-48725](https://cve.now/CVE-2025-48725.md): QuTS hero (CVSS 0.6)
- [CVE-2025-52868](https://cve.now/CVE-2025-52868.md): Qsync Central (CVSS 0.6)
- [CVE-2025-52869](https://cve.now/CVE-2025-52869.md): Qsync Central (CVSS 0.6)
- [CVE-2025-52870](https://cve.now/CVE-2025-52870.md): Qsync Central (CVSS 0.6)
- [CVE-2025-53598](https://cve.now/CVE-2025-53598.md): Qsync Central (CVSS 0.6)
- [CVE-2025-54146](https://cve.now/CVE-2025-54146.md): Qsync Central (CVSS 1.3)
- [CVE-2025-54147](https://cve.now/CVE-2025-54147.md): Qsync Central (CVSS 1.3)
- [CVE-2025-54148](https://cve.now/CVE-2025-54148.md): Qsync Central (CVSS 1.3)
- [CVE-2025-54149](https://cve.now/CVE-2025-54149.md): Qsync Central (CVSS 4.9)
- [CVE-2025-54150](https://cve.now/CVE-2025-54150.md): Qsync Central (CVSS 4.9)
- [CVE-2025-54151](https://cve.now/CVE-2025-54151.md): Qsync Central (CVSS 4.9)
- [CVE-2025-54152](https://cve.now/CVE-2025-54152.md): Qsync Central (CVSS 1.3)
- [CVE-2025-54155](https://cve.now/CVE-2025-54155.md): File Station 5 (CVSS 3.6)
- [CVE-2025-54161](https://cve.now/CVE-2025-54161.md): File Station 5 (CVSS 3.6)
- [CVE-2025-54162](https://cve.now/CVE-2025-54162.md): File Station 5 (CVSS 4.8)
- [CVE-2025-54163](https://cve.now/CVE-2025-54163.md): File Station 5 (CVSS 1.2)
- [CVE-2025-54169](https://cve.now/CVE-2025-54169.md): File Station 5 (CVSS 4.9)
- [CVE-2025-54170](https://cve.now/CVE-2025-54170.md): Qsync Central (CVSS 4.9)
- [CVE-2025-57707](https://cve.now/CVE-2025-57707.md): File Station 5 (CVSS 1.1)
- [CVE-2025-57708](https://cve.now/CVE-2025-57708.md): Qsync Central (CVSS 2.3)
- [CVE-2025-57709](https://cve.now/CVE-2025-57709.md): Qsync Central (CVSS 1.3)
- [CVE-2025-57710](https://cve.now/CVE-2025-57710.md): Qsync Central (CVSS 3.6)
- [CVE-2025-57711](https://cve.now/CVE-2025-57711.md): Qsync Central (CVSS 3.6)
- [CVE-2025-57713](https://cve.now/CVE-2025-57713.md): File Station 5 (CVSS 1.3)
- [CVE-2025-58466](https://cve.now/CVE-2025-58466.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-58467](https://cve.now/CVE-2025-58467.md): Qsync Central (CVSS 1.3)
- [CVE-2025-58470](https://cve.now/CVE-2025-58470.md): Qsync Central (CVSS 1.3)
- [CVE-2025-58471](https://cve.now/CVE-2025-58471.md): Qsync Central (CVSS 1.2)
- [CVE-2025-58472](https://cve.now/CVE-2025-58472.md): Qsync Central (CVSS 1.2)
- [CVE-2025-59386](https://cve.now/CVE-2025-59386.md): QuTS hero (CVSS 1.2)
- [CVE-2025-62853](https://cve.now/CVE-2025-62853.md): File Station 5 (CVSS 5.2)
- [CVE-2025-62854](https://cve.now/CVE-2025-62854.md): File Station 5 (CVSS 1.3)
- [CVE-2025-62855](https://cve.now/CVE-2025-62855.md): File Station 5 (CVSS 1.3)
- [CVE-2025-62856](https://cve.now/CVE-2025-62856.md): File Station 5 (CVSS 1.3)
- [CVE-2025-66274](https://cve.now/CVE-2025-66274.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-66277](https://cve.now/CVE-2025-66277.md): QTS, QuTS hero (CVSS 9.2)
- [CVE-2025-66278](https://cve.now/CVE-2025-66278.md): File Station 5 (CVSS 1.3)
- [CVE-2025-68406](https://cve.now/CVE-2025-68406.md): Qsync Central (CVSS 1.3)
- [CVE-2026-22894](https://cve.now/CVE-2026-22894.md): File Station 5 (CVSS 1.3)
- [CVE-2025-59389](https://cve.now/CVE-2025-59389.md): Hyper Data Protector (CVSS 8.1)
- [CVE-2025-62842](https://cve.now/CVE-2025-62842.md): HBS 3 Hybrid Backup Sync (CVSS 7.0)
- [CVE-2025-62840](https://cve.now/CVE-2025-62840.md): HBS 3 Hybrid Backup Sync (CVSS 7.0)
- [CVE-2025-11837](https://cve.now/CVE-2025-11837.md): Malware Remover (CVSS 8.1)
- [CVE-2025-62852](https://cve.now/CVE-2025-62852.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-59387](https://cve.now/CVE-2025-59387.md): MARS (Multi-Application Recovery Service) (CVSS 8.1)
- [CVE-2025-59384](https://cve.now/CVE-2025-59384.md): Qfiling (CVSS 8.1)
- [CVE-2025-59381](https://cve.now/CVE-2025-59381.md): QTS, QuTS hero (CVSS 6.9)
- [CVE-2025-59380](https://cve.now/CVE-2025-59380.md): QTS, QuTS hero (CVSS 4.6)
- [CVE-2025-53597](https://cve.now/CVE-2025-53597.md): License Center (CVSS 1.2)
- [CVE-2025-53594](https://cve.now/CVE-2025-53594.md): Qfinder Pro, Qsync, QVPN (CVSS 4.4)
- [CVE-2025-52871](https://cve.now/CVE-2025-52871.md): License Center (CVSS 1.3)
- [CVE-2025-48721](https://cve.now/CVE-2025-48721.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-9110](https://cve.now/CVE-2025-9110.md): QTS, QuTS hero (CVSS 2.7)
- [CVE-2025-57705](https://cve.now/CVE-2025-57705.md): QTS, QuTS hero (CVSS 4.6)
- [CVE-2025-54166](https://cve.now/CVE-2025-54166.md): QTS, QuTS hero (CVSS 4.6)
- [CVE-2025-54165](https://cve.now/CVE-2025-54165.md): QTS, QuTS hero (CVSS 4.6)
- [CVE-2025-54164](https://cve.now/CVE-2025-54164.md): QTS, QuTS hero (CVSS 4.6)
- [CVE-2025-53596](https://cve.now/CVE-2025-53596.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-53593](https://cve.now/CVE-2025-53593.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-53592](https://cve.now/CVE-2025-53592.md): QTS, QuTS hero (CVSS 1.3)
- [CVE-2025-53591](https://cve.now/CVE-2025-53591.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-53590](https://cve.now/CVE-2025-53590.md): QTS (CVSS 1.2)
- [CVE-2025-53589](https://cve.now/CVE-2025-53589.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-53414](https://cve.now/CVE-2025-53414.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-53405](https://cve.now/CVE-2025-53405.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-52872](https://cve.now/CVE-2025-52872.md): QTS, QuTS hero (CVSS 1.3)
- [CVE-2025-52864](https://cve.now/CVE-2025-52864.md): QTS, QuTS hero (CVSS 1.3)
- [CVE-2025-52863](https://cve.now/CVE-2025-52863.md): QTS, QuTS hero (CVSS 1.3)
- [CVE-2025-52431](https://cve.now/CVE-2025-52431.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-52430](https://cve.now/CVE-2025-52430.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-52426](https://cve.now/CVE-2025-52426.md): QTS, QuTS hero (CVSS 1.2)
- [CVE-2025-47208](https://cve.now/CVE-2025-47208.md): QTS, QuTS hero (CVSS 4.9)
- [CVE-2025-44013](https://cve.now/CVE-2025-44013.md): QTS, QuTS hero (CVSS 1.3)
- [CVE-2025-62857](https://cve.now/CVE-2025-62857.md): QuMagie (CVSS 2.2)
- [CVE-2025-59385](https://cve.now/CVE-2025-59385.md): QTS, QuTS hero (CVSS 8.1)
- [CVE-2025-62847](https://cve.now/CVE-2025-62847.md): QTS, QuTS hero (CVSS 6.6)
- [CVE-2025-62848](https://cve.now/CVE-2025-62848.md): QTS, QuTS hero (CVSS 8.1)
- [CVE-2025-62849](https://cve.now/CVE-2025-62849.md): QTS, QuTS hero (CVSS 5.2)
- [CVE-2017-20210](https://cve.now/CVE-2017-20210.md): Photo Station (CVSS 9.8)
- [CVE-2025-47207](https://cve.now/CVE-2025-47207.md): File Station 5 (CVSS 5.3)
- [CVE-2025-52425](https://cve.now/CVE-2025-52425.md): QuMagie (CVSS 9.5)
- [CVE-2025-52865](https://cve.now/CVE-2025-52865.md): File Station 5 (CVSS 1.3)
- [CVE-2025-53408](https://cve.now/CVE-2025-53408.md): File Station 5 (CVSS 1.3)
- [CVE-2025-53409](https://cve.now/CVE-2025-53409.md): File Station 5 (CVSS 4.9)
- [CVE-2025-53410](https://cve.now/CVE-2025-53410.md): File Station 5 (CVSS 4.9)
- [CVE-2025-53411](https://cve.now/CVE-2025-53411.md): File Station 5 (CVSS 1.2)
- [CVE-2025-53412](https://cve.now/CVE-2025-53412.md): File Station 5 (CVSS 0.6)
- [CVE-2025-53413](https://cve.now/CVE-2025-53413.md): File Station 5 (CVSS 4.9)
- [CVE-2025-54167](https://cve.now/CVE-2025-54167.md): Notification Center (CVSS 7.2)
- [CVE-2025-54168](https://cve.now/CVE-2025-54168.md): QuLog Center (CVSS 2.2)
- [CVE-2025-57706](https://cve.now/CVE-2025-57706.md): File Station 5 (CVSS 2.2)
- [CVE-2025-57712](https://cve.now/CVE-2025-57712.md): Qsync Central (CVSS 4.0)
- [CVE-2025-58463](https://cve.now/CVE-2025-58463.md): Download Station (CVSS 2.3)
- [CVE-2025-58464](https://cve.now/CVE-2025-58464.md): QuMagie (CVSS 7.8)
- [CVE-2025-58465](https://cve.now/CVE-2025-58465.md): Download Station (CVSS 2.2)
- [CVE-2025-58469](https://cve.now/CVE-2025-58469.md): QuLog Center (CVSS 1.2)
- [CVE-2025-57714](https://cve.now/CVE-2025-57714.md): NetBak Replicator (CVSS 8.5)
- [CVE-2025-54154](https://cve.now/CVE-2025-54154.md): QNAP Authenticator (CVSS 6.9)
- [CVE-2025-54153](https://cve.now/CVE-2025-54153.md): Qsync Central (CVSS 8.6)
- [CVE-2025-53595](https://cve.now/CVE-2025-53595.md): Qsync Central (CVSS 8.6)
- [CVE-2025-53407](https://cve.now/CVE-2025-53407.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-53406](https://cve.now/CVE-2025-53406.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52867](https://cve.now/CVE-2025-52867.md): Qsync Central (CVSS 6.0)
- [CVE-2025-52866](https://cve.now/CVE-2025-52866.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52862](https://cve.now/CVE-2025-52862.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52860](https://cve.now/CVE-2025-52860.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52859](https://cve.now/CVE-2025-52859.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52858](https://cve.now/CVE-2025-52858.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52857](https://cve.now/CVE-2025-52857.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52855](https://cve.now/CVE-2025-52855.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52854](https://cve.now/CVE-2025-52854.md): QTS, QuTS hero (CVSS 5.1)
- [CVE-2025-52853](https://cve.now/CVE-2025-52853.md): QTS, QuTS hero (CVSS 5.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/qnap-systems
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.