Known vulnerabilities in QNAP QTS

Software: QNAP QTS
Software CPE: cpe:2.3:a:qnap_systems:qnap_qts:*:*:*:*:*:*:*:*
Total vulnerabilities: 353
Public exploits: 21
Known exploited (KEV): 14
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting QNAP QTS QNAP QTS is affected by 353 known vulnerabilities: 7 critical, 61 high, 121 medium, 164 low Critical High Medium Low

Vulnerabilities (353)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134947 - NULL Pointer Dereference
CVE-2025-66281
CWE-476 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU134946 - Allocation of Resources Without Limits or Throttling
CVE-2026-24720
CWE-770 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU134945 - NULL Pointer Dereference
CVE-2026-22899
CWE-476 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU134944 - Incorrect Authorization
CVE-2026-24724
CWE-863 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU134943 - Stack-based buffer overflow
CVE-2026-26241
CWE-121 High
No
No
5.2.10 19.06.2026 SB20260619105
#VU134941 - Stack-based buffer overflow
CVE-2026-26240
CWE-121 High
No
No
5.2.10 19.06.2026 SB20260619105
#VU134940 - Stack-based buffer overflow
CVE-2026-26239
CWE-121 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU134938 - Stack-based buffer overflow
CVE-2025-68405
CWE-121 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134937 - Stack-based buffer overflow
CVE-2025-66280
CWE-121 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134936 - Stack-based buffer overflow
CVE-2025-62858
CWE-121 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134935 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-22893
CWE-78 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134934 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66279
CWE-78 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134933 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66273
CWE-78 Low
No
No
5.2.10 19.06.2026 SB20260619105
#VU134921 - External Control of Assumed-Immutable Web Parameter
CVE-2025-59382
CWE-472 Medium
No
No
5.2.10 19.06.2026 SB20260619105
#VU130763 - Resource Management Errors
CVE-2026-43284
CWE-399 High
Available
Exploited
- 08.05.2026 SB20260508111
SB20260508120
SB20260508121
and 72 more
#VU130759 - Resource Management Errors
CVE-2026-43500
CWE-399 High
Available
Exploited
- 08.05.2026 SB20260508108
SB20260508120
SB20260508121
and 32 more
#VU122753 - Improper Link Resolution Before File Access ('Link Following')
CVE-2025-66277
CWE-59 High
No
No
5.2.8.3350 20251216 12.02.2026 SB2026021231
#VU122752 - NULL Pointer Dereference
CVE-2025-47205
CWE-476 Low
No
No
5.2.8.3350 20251216 12.02.2026 SB2026021231
#VU122751 - Use of Uninitialized Variable
CVE-2025-58466
CWE-457 Low
No
No
5.2.8.3350 20251216 12.02.2026 SB2026021231
#VU122134 - Configuration
CVE-2025-66276
CWE-16 High
No
No
5.2.0 30.01.2026 SB2026013003


Showing elements 1 - 20 out of 353