Known vulnerabilities in QuTS hero

Software: QuTS hero
Software CPE: cpe:2.3:h:qnap_systems:quts-hero:*:*:*:*:*:*:*:*
Total vulnerabilities: 293
Public exploits: 16
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting QuTS hero QuTS hero is affected by 293 known vulnerabilities: 5 critical, 42 high, 98 medium, 148 low Critical High Medium Low

Vulnerabilities (293)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134947 - NULL Pointer Dereference
CVE-2025-66281
CWE-476 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134946 - Allocation of Resources Without Limits or Throttling
CVE-2026-24720
CWE-770 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134945 - NULL Pointer Dereference
CVE-2026-22899
CWE-476 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134944 - Incorrect Authorization
CVE-2026-24724
CWE-863 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134943 - Stack-based buffer overflow
CVE-2026-26241
CWE-121 High
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134941 - Stack-based buffer overflow
CVE-2026-26240
CWE-121 High
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134940 - Stack-based buffer overflow
CVE-2026-26239
CWE-121 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134938 - Stack-based buffer overflow
CVE-2025-68405
CWE-121 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134937 - Stack-based buffer overflow
CVE-2025-66280
CWE-121 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134936 - Stack-based buffer overflow
CVE-2025-62858
CWE-121 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134935 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-22893
CWE-78 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134934 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66279
CWE-78 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134933 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66273
CWE-78 Low
No
No
h5.2.9 19.06.2026 SB20260619105
#VU134921 - External Control of Assumed-Immutable Web Parameter
CVE-2025-59382
CWE-472 Medium
No
No
h5.2.9 19.06.2026 SB20260619105
#VU130763 - Resource Management Errors
CVE-2026-43284
CWE-399 High
Available
Exploited
- 08.05.2026 SB20260508111
SB20260508120
SB20260508121
and 72 more
#VU130759 - Resource Management Errors
CVE-2026-43500
CWE-399 High
Available
Exploited
- 08.05.2026 SB20260508108
SB20260508120
SB20260508121
and 32 more
#VU122753 - Improper Link Resolution Before File Access ('Link Following')
CVE-2025-66277
CWE-59 High
No
No
h5.2.8.3350 build 20251216 12.02.2026 SB2026021231
#VU122752 - NULL Pointer Dereference
CVE-2025-47205
CWE-476 Low
No
No
h5.2.8.3350 build 20251216 12.02.2026 SB2026021231
#VU122751 - Use of Uninitialized Variable
CVE-2025-58466
CWE-457 Low
No
No
h5.2.8.3350 build 20251216 12.02.2026 SB2026021231
#VU122741 - Memory corruption
CVE-2025-48725
CWE-119 Low
No
No
h5.3.2.3354 build 20251225 12.02.2026 SB2026021206


Showing elements 1 - 20 out of 293