QNAP Systems Inc. QTS

Name: QNAP Systems Inc. QTS
Brand: QNAP Systems Inc.

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

21critical109high109medium3low

updated 2026-10-27

vulnerabilities (249)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-2509US	critical9.8OT critical	34.0% (98th)	KEV	4.2.6 Build 20210327	2021-04-17	6 versions
CVE-2018-19953US	medium6.1OT critical	30.5% (98th)	KEV	4.4.2.1231	2020-10-28	6 versions
CVE-2018-19949US	critical9.8OT critical	30.2% (98th)	KEV	4.3.4.1190	2020-10-28	6 versions
CVE-2018-19943US	medium5.4OT critical	22.7% (98th)	KEV	4.4.1.1261	2020-10-28	6 versions
CVE-2023-47218US	high8.3	89.9% (100th)	Exploit	5.1.5.2645 build 20240116	2024-02-13	2 versions
CVE-2024-27130US	high8.8	37.5% (99th)	Exploit	5.1.7.2770 build 20240520	2024-05-21	5.1.x → 5.1.7.2770 build 20240520
CVE-2024-53691US	high8.8	23.8% (98th)	Exploit	5.1.8.2823 build 20240712	2024-12-06	2 versions
CVE-2023-51364US	high7.5	39.7% (99th)	—	5.1.4.2596 build 20231128	2024-04-26	3 versions
CVE-2023-51365US	high7.5	34.8% (98th)	—	4.5.4.2627 build 20231225	2024-04-26	3 versions
CVE-2024-21899US	critical9.8	24.4% (98th)	—	4.5.4.2627 build 20231225	2024-03-08	3 versions
CVE-2023-23368US	critical9.8	18.7% (97th)	—	4.5.4.2374 build 20230416	2023-11-03	2 versions
CVE-2024-21901US	medium4.7	18.7% (97th)	—	4.5.4.2627 build 20231225	2024-03-08	2 versions
CVE-2023-23369US	critical9.8	14.4% (97th)	—	4.2.6 build 20230621	2023-11-03	5 versions
CVE-2023-50358US	—	13.5% (96th)	—	5.1.5.2645 build 20240116	2024-02-13	6 versions
CVE-2024-21900US	medium6.5	9.41% (95th)	—	5.1.3.2578 build 20231110	2024-03-08	5.1.x → 5.1.3.2578 build 20231110
CVE-2019-7198US	critical9.8	2.72% (86th)	—	no fix	2020-12-10	2 versions
CVE-2022-27596US	critical9.8	2.66% (86th)	—	5.0.1.2234 build 20221201	2023-01-30	5.0.1 → 5.0.1.2234 build 20221201
CVE-2020-25847US	high8.8	2.58% (85th)	—	4.5.1.1495	2020-12-29	2 versions
CVE-2024-32766US	—	2.31% (83rd)	—	5.1.3.2578 build 20231110	2024-04-26	3 versions
CVE-2020-2490US	high7.2	2.21% (82nd)	—	4.4.3.1421	2020-11-16	unspecified → 4.4.3.1421
CVE-2021-34343US	high7.2	1.95% (80th)	—	4.5.4.1715 build 20210630	2021-09-10	2 versions
CVE-2020-2508US	high7.2	1.85% (79th)	—	no fix	2021-01-11	≤ < 4.5.1.1456
CVE-2021-28804US	critical9.8	1.82% (79th)	—	4.5.1.1540 build 20210107	2021-07-01	unspecified → 4.5.1.1540 build 20210107
CVE-2021-28802US	critical9.8	1.82% (79th)	—	4.5.1.1540 build 20210107	2021-07-01	unspecified → 4.5.1.1540 build 20210107
CVE-2020-36195US	critical9.8	1.76% (78th)	—	4.3.6.1620 Build 20210322	2021-04-17	2 versions
CVE-2020-2492US	high7.2	1.70% (77th)	—	4.4.3.1421	2020-11-16	unspecified → 4.4.3.1421
CVE-2025-30264US	high8.8	1.67% (77th)	—	5.2.5.3145 build 20250526	2025-08-29	5.2.x → 5.2.5.3145 build 20250526
CVE-2021-44051US	high8.8	1.66% (77th)	—	5.0.0.1986 build 20220324	2022-05-05	unspecified → 5.0.0.1986 build 20220324
CVE-2023-23362US	high8.8	1.60% (76th)	—	4.5.4.2374 build 20230416	2023-09-22	2 versions
CVE-2021-44052US	high8.1	1.59% (76th)	—	4.5.4.1991 build 20220329	2022-05-05	6 versions
CVE-2023-39296US	high7.5	1.56% (75th)	—	5.1.3.2578 build 20231110	2024-01-05	5.1.x → 5.1.3.2578 build 20231110
CVE-2018-0721US	high10.0	1.55% (75th)	—	no fix	2018-11-27	3 versions
CVE-2023-23367US	high7.2	1.50% (74th)	—	5.0.1.2376 build 20230421	2023-11-10	5.0.x → 5.0.1.2376 build 20230421
CVE-2024-27124US	—	1.44% (73rd)	—	5.1.3.2578 build 20231110	2024-04-26	3 versions
CVE-2021-28800US	critical9.8	1.43% (73rd)	—	4.3.3.1624 Build 20210416	2021-06-24	2 versions
CVE-2023-39297US	high8.8	1.41% (72nd)	—	4.5.4.2627 build 20231225	2024-02-02	2 versions
CVE-2025-47212US	high7.2	1.33% (71st)	—	5.2.6.3195 build 20250715	2025-10-03	5.2.x → 5.2.6.3195 build 20250715
CVE-2024-50393US	critical9.8	1.31% (70th)	—	5.1.9.2954 build 20241120	2024-12-06	2 versions
CVE-2023-23355US	high7.2	1.23% (69th)	—	5.0.1.2346 build 20230322	2023-03-29	2 versions
CVE-2023-34975US	high8.8	1.22% (69th)	—	4.5.4.2627 build 20231225	2023-10-13	4.5.x → 4.5.4.2627 build 20231225
CVE-2024-21898US	high8.8	1.21% (68th)	—	5.1.6.2722 build 20240402	2024-09-06	5.1.x → 5.1.6.2722 build 20240402
CVE-2023-39300US	high7.2	1.21% (68th)	—	4.3.4.2814 build 20240618	2024-09-06	4 versions
CVE-2023-47566US	high7.2	1.18% (67th)	—	5.1.5.2645 build 20240116	2024-02-02	5.1.x → 5.1.5.2645 build 20240116
CVE-2023-45025US	critical9.8	1.13% (66th)	—	5.1.4.2596 build 20231128	2024-02-02	2 versions
CVE-2018-19945US	critical9.1	1.12% (66th)	—	4.3.6.0895	2020-12-31	2 versions
CVE-2023-39294US	high7.2	1.12% (66th)	—	5.1.3.2578 build 20231110	2024-01-05	5.1.x → 5.1.3.2578 build 20231110
CVE-2023-47567US	high7.2	1.11% (66th)	—	5.1.5.2645 build 20240116	2024-02-02	2 versions
CVE-2026-22893US	high7.2	1.09% (65th)	—	5.2.9.3410 build 20260214	2026-06-10	5.2.0 → 5.2.9.3410 build 20260214
CVE-2023-34979US	high7.2	1.07% (65th)	—	4.5.4.2790 build 20240605	2024-09-06	4.5.x → 4.5.4.2790 build 20240605
CVE-2023-39302US	high7.2	1.07% (65th)	—	5.1.3.2578 build 20231110	2024-02-02	5.1.x → 5.1.3.2578 build 20231110

showing 50 of 249

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')47 CVEs
CWE-476NULL Pointer Dereference46 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')43 CVEs
CWE-121Stack-based Buffer Overflow25 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')21 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')19 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')17 CVEs
CWE-134Use of Externally-Controlled Format String13 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)249 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan