These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A path traversal vulnerability has been reported in Qsirch, which could allow remote attackers to read unexpected files or system data if exploited. The vulnerability has been fixed in Qsirch version 7.0.3.0 and later. Defenders should assess exposure and apply the vendor-provided fix to prevent potential data exposure and detect potential exploitation attempts. The CVE record and NVD entry provide limite [truncated]
A cross-site scripting (XSS) vulnerability has been reported in QuFTP Service. If a remote attacker gains a user account, they can exploit the vulnerability to inject malicious code. The vulnerability has been fixed in QuFTP Service 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later. Defenders should review the official advisory for affected scope, severity, and vendor guidance. The vulnerability requi [truncated]
A critical OS command injection vulnerability, CVE-2026-47786, has been reported in HybridDesk Station. If exploited, it could allow remote attackers to execute arbitrary commands. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. It has been fixed in HybridDesk Station 4.2.23 and later, and 4.3.4 and later. System administrators and security teams should assess exposure and apply p [truncated]
A missing authentication vulnerability in HybridDesk Station could allow remote attackers to gain system access if exploited. QNAP has fixed this issue in HybridDesk Station version 4.2.22 and later. This vulnerability affects HybridDesk Station systems, which may be exposed to unauthorized access if not updated. Defenders should verify the version of HybridDesk Station in use and apply the fix to prevent [truncated]
A cross-site scripting (XSS) vulnerability has been reported in Notes Station 3. If a remote attacker gains a user account, they can exploit the vulnerability to inject malicious code. The vulnerability has been fixed in Notes Station 3 version 3.9.12 and later. Defenders should assess exposure and apply the vendor-provided fix to prevent potential code injection and malicious activity. This involves veri [truncated]
A local attacker with an administrator account can exploit an improper isolation or compartmentalization vulnerability in Notes Station 3 to compromise system security. The vulnerability has been fixed in Notes Station 3 version 3.9.11 and later. This issue allows an attacker to potentially gain unauthorized access or control over the system, emphasizing the need for immediate attention from administrator [truncated]
A local attacker with a user account can exploit an incorrect permission assignment vulnerability in Notes Station 3 to compromise system security. The vulnerability is fixed in Notes Station 3 version 3.9.11 and later. This issue highlights the importance of proper permission management and regular security updates. Defenders should assess their exposure and apply the vendor-provided fix to prevent explo [truncated]
A CVE record indicates an OS command injection vulnerability in Notes Station 3, which could allow remote attackers to execute arbitrary commands if exploited. The vulnerability has been fixed in Notes Station 3 version 3.9.11 and later. This vulnerability affects Notes Station 3 deployments, and defenders should assess exposure and apply the vendor-provided fix to prevent potential exploitation. The CVE [truncated]
A high-severity vulnerability has been reported in Virtualization Station, allowing a remote attacker with a user account to compromise system security by exploiting an improper link resolution before file access (link following) vulnerability. This vulnerability, known as CVE-2026-53882, affects Virtualization Station versions prior to 4.1.1.130. Defenders should assess exposure and apply patches promptl [truncated]
A unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. The vulnerability has already been fixed in QuMagie 2.9.2 and later. This vulnerability is critical with a CVSS score of 9.4, indicating a high severity level. Defenders should assess exposur [truncated]
A high-severity authorization bypass vulnerability has been reported in Video Station, an application potentially exposed to remote network attacks. If exploited, it could allow remote attackers to obtain sensitive data. The vulnerability has already been fixed in Video Station 5.8.8 and later. Defenders should verify exposure and apply the fix to prevent potential exploitation and data exposure. This vul [truncated]
A relative path traversal vulnerability has been reported in QuMagie, which could allow an attacker with administrator privileges to read unexpected files or system data. The vulnerability has been fixed in QuMagie version 2.9.1 and later. This issue is significant because it could allow an attacker to access sensitive information. Defenders should assess exposure and apply the vendor-provided fix to prev [truncated]
A unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in Qsync Central 5.0.0.7 and later, 5.1.0.3 and later, 5.2.0.5 and later, and 5.3.0.2 and later. Defenders should assess exposure and apply patches if n [truncated]
A server-side request forgery (SSRF) vulnerability has been reported in Download Station. If a remote attacker gains a user account, they can exploit the vulnerability to read application data. The vulnerability has been fixed in Download Station 5.10.1.312 and later, and 5.11.2.321 and later. This SSRF issue allows attackers with user accounts to access application data, potentially leading to data expos [truncated]
An incorrect permission assignment vulnerability affects Download Station. Local attackers with administrator accounts can exploit this to compromise system security. The vulnerability has been fixed in Download Station 5.10.1.312 and 5.11.2.321 or later. System administrators should verify patch application to prevent exploitation. This involves reviewing system security logs for suspicious activity and [truncated]
A critical vulnerability, CVE-2026-34006, has been reported in sMedio DTCP MOVE, allowing remote attackers to gain system access if exploited. The issue, a missing authentication for a critical function, has been fixed in version 1.4.5 and later. This vulnerability has a CVSS score of 9.3, indicating critical severity. Defenders and administrators of systems using sMedio DTCP MOVE should assess exposure a [truncated]
A SQL injection vulnerability has been reported in Video Station, a remote code execution risk if exploited by attackers with valid user credentials. The vulnerability allows attackers to execute unauthorized code or commands. It has been fixed in Video Station 5.8.8 and later versions. Defenders should assess exposure and apply the vendor-provided fix to prevent potential exploitation. The vulnerability' [truncated]
A SQL injection vulnerability has been reported in Video Station, a component used for video management. If a remote attacker gains a user account, they can exploit the vulnerability to execute unauthorized code or commands. The vulnerability was fixed in Video Station 5.8.8 and later. This issue is significant because it could allow attackers to gain further access and control within the network. Defende [truncated]
A path traversal vulnerability affects Qsync Central, allowing an attacker with a user account to read unexpected files or system data. The vendor has fixed the issue in Qsync Central 5.0.0.6, 5.1.0.2, and 5.2.0.4 or later versions. This vulnerability can lead to unauthorized data access, and defenders should assess exposure and prioritize patching. The vendor's advisory provides the primary source of inf [truncated]
A path traversal vulnerability in QcalAgent can allow a remote attacker with a user account to read unexpected files or system data. The vulnerability has been fixed in QcalAgent version 1.1.10 and later. Defenders should assess exposure and apply the vendor-provided fix to prevent potential exploitation. The vulnerability can lead to arbitrary file moves, Docker escape, and host RCE. Verification of Qcal [truncated]
A relative path traversal vulnerability has been reported in QNAP Download Station. If a remote attacker gains a user account, they can exploit the vulnerability to read unexpected files or system data. This vulnerability affects QNAP Download Station versions prior to 5.10.2.313 and 5.11.3.322. Defenders should assess exposure and apply patches if necessary. The vulnerability allows an attacker to read u [truncated]
A NULL pointer dereference vulnerability in File Station 5's utilRequest.cgi can allow a remote attacker with a user account to launch a denial-of-service (DoS) attack. QNAP Systems Inc. has fixed the vulnerability in File Station 5 version 5.5.6.5243 and later. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The CVE Program and NVD records confirm the vulnerability and its details. Ad [truncated]
A NULL pointer dereference vulnerability in File Station 5 can allow a remote attacker with a user account to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in version 5.5.6.5243 and later. This medium-severity vulnerability affects File Station 5 installations, particularly those exposed to the internet or untrusted networks, and requires prompt assessment and remediation to pr [truncated]
A NULL pointer dereference vulnerability affects File Station 5, potentially allowing a remote attacker with a user account to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in version 5.5.6.5243 and later. This issue requires attention from system administrators and security teams to prevent potential DoS attacks. A remote attacker with a user account could exploit the vulnerab [truncated]
A path traversal vulnerability in Qsync Central's qsyncsrv.cgi allows remote attackers with a user account to read unexpected files or system data. The vulnerability has been fixed in Qsync Central versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later. This vulnerability is considered medium-priority for patching and verification, especially for versions prior to the fixed releases. Qsync Central admi [truncated]
A vulnerability has been reported in QuRouter, an observable timing discrepancy vulnerability that could allow remote attackers to obtain sensitive data. The details are limited, but the vendor has fixed the vulnerability in QuRouter 2.7.2.113 and later. Defenders should verify the version and apply the patch if necessary. They should also monitor QuRouter for suspicious activity and review network config [truncated]
A stored XSS vulnerability affects QNAP Systems Inc.'s Network & Virtual Switch, an administrator account is required for exploitation. Fixed versions are available for QTS 5.1.8.2823 build 20240712 and later, QTS 5.2.1.2930 build 20241025 and later, QuTS cloud c5.2.4.3041 build 20250211 and later, QuTS hero h5.1.8.2823 build 20240712 and later, and QuTS hero h5.2.1.2929 build 20241025 and later. The vuln [truncated]
A time-of-check time-of-use (toctou) race condition vulnerability has been reported in QuRouter, which could allow remote attackers to compromise system security if exploited. The vulnerability has been fixed in QuRouter version 2.6.4.001 and later. This vulnerability affects QuRouter deployments, and defenders should verify exposure and apply the fixed version to prevent potential system compromise. The [truncated]
A local attacker with administrator privileges can exploit an external control of system or configuration setting vulnerability in QuRouter to modify system data. The vulnerability has been fixed in QuRouter version 2.7.2.113 and later. Defenders should assess exposure and apply the vendor-provided patch. This vulnerability allows an attacker to modify system data, which could lead to unauthorized changes [truncated]
A path traversal vulnerability in Video Station could allow a remote attacker with a user account to read unexpected files or system data. The vulnerability has been fixed in Video Station 5.8.5 and later. Defenders should assess exposure and prioritize upgrading to version 5.8.5 or later. This vulnerability could lead to potential unauthorized data access and defenders need to verify Video Station instal [truncated]
