Known vulnerabilities in QVP (QVR Pro appliances)

Vendor: QNAP Systems, Inc.
Software: QVP (QVR Pro appliances)
Software CPE: cpe:2.3:h:qnap_systems:qvp_qvr_pro_appliances:*:*:*:*:*:*:*:*
Website: https://www.qnap.com
Total vulnerabilities: 22
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting QVP (QVR Pro appliances) QVP (QVR Pro appliances) is affected by 22 known vulnerabilities: 2 high, 11 medium, 9 low Critical High Medium Low

Vulnerabilities (22)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134947 - NULL Pointer Dereference
CVE-2025-66281		 CWE-476 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134946 - Allocation of Resources Without Limits or Throttling
CVE-2026-24720		 CWE-770 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134945 - NULL Pointer Dereference
CVE-2026-22899		 CWE-476 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134944 - Incorrect Authorization
CVE-2026-24724		 CWE-863 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134943 - Stack-based buffer overflow
CVE-2026-26241		 CWE-121 High
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134941 - Stack-based buffer overflow
CVE-2026-26240		 CWE-121 High
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134940 - Stack-based buffer overflow
CVE-2026-26239		 CWE-121 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134938 - Stack-based buffer overflow
CVE-2025-68405		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134937 - Stack-based buffer overflow
CVE-2025-66280		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134936 - Stack-based buffer overflow
CVE-2025-62858		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134935 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-22893		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134934 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66279		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134933 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66273		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134921 - External Control of Assumed-Immutable Web Parameter
CVE-2025-59382		 CWE-472 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU78741 - Resource exhaustion
CVE-2022-27600		 CWE-400 Low
No
No
 2.3.1.0476 28.07.2023 SB2023072811
#VU74200 - Command injection
CVE-2023-23355		 CWE-77 Medium
No
No
 - 30.03.2023 SB2023033031
#VU71332 - Improper input validation
CVE-2023-22809		 CWE-20 Low
Available
No
 - 18.01.2023 SB20230118100
SB20230118104
SB20230118105
and 55 more
#VU69337 - Integer overflow
CVE-2022-42898		 CWE-190 Medium
No
No
 - 15.11.2022 SB2022111530
SB2022111610
SB2022111621
and 123 more
#VU68701 - Heap-based Buffer Overflow
CVE-2022-3437		 CWE-122 Low
No
No
 - 25.10.2022 SB2022102524
SB2022102558
SB2022102521
and 33 more
#VU68700 - UNIX Symbolic Link (Symlink) Following
CVE-2022-3592		 CWE-61 Medium
No
No
 - 25.10.2022 SB2022102524
SB2023033037
SB2023091702
and 4 more


Showing elements 1 - 20 out of 22