QS
Vendor security profile3 actively exploited CVEs
QNAP Systems Inc.
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs41
Critical5
CISA KEV3
Public exploit3
Patch rate%0
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
0
2
35
CVE KEV
CVE severity distribution
41toplam CVE
Critical5 (12%)
High17 (41%)
Medium16 (39%)
Low3 (7%)
Patch and exploitation view
%0
Verified patch
%7
CISA KEV
%7
Public exploit
0Patch available
0Partial
3Workaround
0Vendor: no patch
38Unknown
Latest vulnerabilities
9.3
CVE-2026-50619
Unauthenticated remote code execution vulnerability
QS
Patch status unknownEPSS %1
6.3
CVE-2026-47790
Privilege Escalation via QuFTP Log-based XSS
QS
Patch status unknownEPSS %0
9.3
CVE-2026-47786
Pre-Authentication Command Injection
QS
Patch status unknownEPSS %1
8.9
CVE-2026-39997
Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
QS
Patch status unknownEPSS %0
4.8
CVE-2026-39991
Stored Cross-Site Scripting (XSS) in Note Station file upload functionality
QS
Patch status unknownEPSS %0
8.4
CVE-2026-34009
**Container Escape** Host user home directory mounted with write access into application container
QS
Patch status unknownEPSS %0
8.5
CVE-2026-34008
**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
QS
Patch status unknownEPSS %0
6.9
CVE-2026-34007
**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`
QS
Patch status unknownEPSS %2
8.7
CVE-2026-53882
Path Traversal in Virtualization Station VM Import
QS
Patch status unknownEPSS %0
9.4
CVE-2026-50612
Import Symlink Following Remote Code Execution Vulnerability in QuMagie
QS
Patch status unknownEPSS %0