Brand
QNAP: actively exploited vulnerabilities
12 vulnerabilities in QNAP products (NAS (QTS / QuTS hero), Photo Station, Helpdesk…) are in CISA’s catalog of exploited vulnerabilities. Last added: December 21, 2023.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
0 vulnerabilities added in the last 12 months
-
12 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one QNAP category to your radar, or open its page.
- Backup, storage and NAS 11 vulnerabilities
- Home and small-office routers, cameras and IoT 1 vulnerability
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
Follow a single QNAP product (NAS (QTS / QuTS hero), Photo Station…) rather than the whole brand.
- NAS (QTS / QuTS hero)6 vulnerabilities, Backup and NAS
- Photo Station4 vulnerabilities, Backup and NAS
- Helpdesk1 vulnerability, Backup and NAS
- VioStor NVR1 vulnerability, Home routers and IoT
Names used by CISA: QNAP, QNAP Systems. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this QNAP list.
- Rank 1
QNAP Photo StationCVE-2019-7192
QNAP Photo Station Improper Access Control Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Jun 8, 2022
- Rank 2
QNAP NAS (QTS / QuTS hero)CVE-2019-7193
QNAP QTS Improper Input Validation Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Jun 8, 2022
- Rank 3
QNAP Photo StationCVE-2019-7194
QNAP Photo Station Path Traversal Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Jun 8, 2022
- Rank 4
QNAP Photo StationCVE-2019-7195
QNAP Photo Station Path Traversal Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Jun 8, 2022
- Rank 5
QNAP NAS (QTS / QuTS hero)CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability
RansomwareCVE from 2018, added in 2022
CVSS severity 9.8critical
Added May 24, 2022
- Rank 6
QNAP NAS (QTS / QuTS hero)CVE-2020-2509
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
CVE from 2020, added in 2022
CVSS severity 9.8critical
Added Apr 11, 2022
- Rank 7
QNAP NAS (QTS / QuTS hero)CVE-2021-28799
QNAP NAS Improper Authorization Vulnerability
Ransomware
CVSS severity 9.8critical
Added Mar 31, 2022
- Rank 8
QNAP HelpdeskCVE-2020-2506
QNAP Helpdesk Improper Access Control Vulnerability
CVE from 2020, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
- Rank 9
QNAP Photo StationCVE-2022-27593
QNAP Photo Station Externally Controlled Reference Vulnerability
Ransomware
CVSS severity 9.1critical
Added Sep 8, 2022
- Rank 10
QNAP VioStor NVRCVE-2023-47565
QNAP VioStor NVR OS Command Injection Vulnerability
CVSS severity 8.8high
Added Dec 21, 2023
Show 2 more vulnerabilities
- Rank 11
QNAP NAS (QTS / QuTS hero)CVE-2018-19953
QNAP NAS File Station Cross-Site Scripting Vulnerability
RansomwareCVE from 2018, added in 2022
CVSS severity 6.1medium
Added May 24, 2022
- Rank 12
QNAP NAS (QTS / QuTS hero)CVE-2018-19943
QNAP NAS File Station Cross-Site Scripting Vulnerability
RansomwareCVE from 2018, added in 2022
CVSS severity 5.4medium
Added May 24, 2022
Follow and verify
Get new QNAP vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).
Indicative classification, based on the vendor and product names given by CISA. How products are classified.