QNAP (Vendor): news timeline & CVEs

Related CVEsby mentions

CVE-2019-07089.8100%

Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)

published May 16, 2019· Microsoft Remote Desktop Services KEV ransomware PoC ×4

CVE-2018-105619.893%

Authentication Bypass in Dasan GPON Home Routers (CVE-2018-10561)

published May 4, 2018· Dasan Networks GPON home router firmware (Dasan Gigabit Passive Optical Network Routers) KEV PoC ×2

CVE-2018-105629.8100%

Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562)

published May 4, 2018· Dasan Gigabit Passive Optical Network (GPON) routers KEV ransomware PoC ×2

CVE-2025-32489.8100%

Unauthenticated RCE in Langflow /api/v1/validate/code

published Apr 7, 2025· Langflow KEV ransomware PoC ×2

CVE-2017-01477.5100%

Information Disclosure in Microsoft Windows SMBv1 Server (CVE-2017-0147)

published Mar 17, 2017· microsoft Windows Vista KEV ransomware PoC ×5

CVE-2020-118995.418%

Out-of-Bounds Read in Treck TCP/IP Stack (IPv6) Affecting Dell Wyse Thin Clients

published Jun 17, 2020· Treck TCP/IP stack (IPv6) KEV PoC

CVE-2019-122609.823%

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4)

published Aug 9, 2019· windriver vxworks

CVE-2019-122559.875%

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4)

published Aug 9, 2019· windriver vxworks PoC

CVE-2024-75917.244%

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects

published Sep 5, 2024· kemptechnologies loadmaster

CVE-2025-465656.01%

Vite: 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be…

published May 1, 2025· vitejs vite PoC

ZDI-26-776: QNAP TS-453E syslog log_message Format String Remote Code Execution Vulnerability

ZDI disclosed an unauthenticated format-string bug in QNAP TS-453E syslog enabling network-adjacent code execution.

The Zero Day Initiative published ZDI-26-776, a format-string vulnerability in the syslog log_message function on QNAP TS-453E devices. Network-adjacent attackers can execute arbitrary code without authentication. ZDI assigned CVSS 7.5 and listed CVE-2018-10388 and CVE-2018-10389. The advisory does not report exploitation in the wild.

ZDI Published AdvisoriesOct 15, 05:00 UTC · 1d agoVulnerability CVE-2018-10388 CVE-2018-103892

The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

Cyble sensors logged exploitation attempts against about 20 flaws as CISA issued 14 ICS advisories.

Cyble's weekly report says its global sensors recorded exploitation attempts against about 20 vulnerabilities, including new flaws in WordPress, Apache Solr, and Langflow and older bugs in GPON routers and embedded TCP/IP stacks. Named issues include WordPress CVE-2026-63030, Solr hardcoded-credential flaw CVE-2026-44825, Langflow CVE-2026-9198, and n8n RCE CVE-2025-68613; CVE-2020-11899 was the most attempted. CISA published 14 ICS advisories covering 54 vulnerabilities, 13 rated critical. Sensors also captured CoinMiner, WannaCry, Mirai and related malware, phishing, brute force, and a MacSync macOS infostealer campaign aimed at crypto users.

CybleOct 14, 13:36 UTC · 2d agoExploit / PoC in the wildCVE-2026-63030 CVE-2026-60137 CVE-2026-44825+22 CVEs1

QNAP

Timeline2 articles

Related CVEsby mentions

Appears with

ZDI-26-776: QNAP TS-453E syslog log_message Format String Remote Code Execution Vulnerability

The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws