Known vulnerabilities in QVP (QVR Pro appliances) 2.7.1

Vendor: QNAP Systems, Inc.
Software: QVP (QVR Pro appliances)
Version: 2.7.1
Software CPE: cpe:2.3:h:qnap_systems:qvp_qvr_pro_appliances:*:*:*:*:*:*:*:*
Website: https://www.qnap.com
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting QVP (QVR Pro appliances) version 2.7.1 QVP (QVR Pro appliances) 2.7.1 is affected by 14 vulnerabilities: 2 high, 6 medium, 6 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134947 - NULL Pointer Dereference
CVE-2025-66281		 CWE-476 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134946 - Allocation of Resources Without Limits or Throttling
CVE-2026-24720		 CWE-770 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134945 - NULL Pointer Dereference
CVE-2026-22899		 CWE-476 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134944 - Incorrect Authorization
CVE-2026-24724		 CWE-863 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134943 - Stack-based buffer overflow
CVE-2026-26241		 CWE-121 High
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134941 - Stack-based buffer overflow
CVE-2026-26240		 CWE-121 High
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134940 - Stack-based buffer overflow
CVE-2026-26239		 CWE-121 Medium
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134938 - Stack-based buffer overflow
CVE-2025-68405		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134937 - Stack-based buffer overflow
CVE-2025-66280		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134936 - Stack-based buffer overflow
CVE-2025-62858		 CWE-121 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134935 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-22893		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134934 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66279		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134933 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-66273		 CWE-78 Low
No
No
 2.8.0 19.06.2026 SB20260619105
#VU134921 - External Control of Assumed-Immutable Web Parameter
CVE-2025-59382		 CWE-472 Medium
No
No
 2.8.0 19.06.2026 SB20260619105