CVE-2025-62854

File Station 5 vulnerability CVE-2025-62854 is an uncontrolled resource consumption issue that can be exploited to cause a DoS when an attacker with a valid user account is present. Affected software: File Station 5. The issue arises within the service when resource consumption is not properly co...

CVE-2025-62855 File Station 5

A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File...

CVE-2025-62855

A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File...

CVE-2025-62856

CVE-2025-62856 affects QNAP File Station 5. A path traversal vulnerability exists in File Station 5 that could allow an administrator to read unexpected files or system data. Root cause: path traversal exposure likely in file read logic; impact is confidentiality (read access) with LOW vulnerable...

CVE-2025-66274

CVE-2025-66274 affects QNAP QTS and QuTS hero; a NULL pointer dereference allows a remote attacker with administrator privileges to trigger a DoS. Remediation: upgrade to QuTS hero h5.3.2.3354 build 20251225 or later (and affected QTS versions). Exploitation details are described as remote with a...

CVE-2025-66278

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-66278

CVE-2025-66278 : A path traversal vulnerability affects File Station 5. If an attacker gains a user account, they can read contents of unexpected files or system data. The issue is fixed in File Station 5 version 5.5.6.5190 and later. The accompanying metrics indicate a CVSS v4.0 base score of 5....

CVE-2025-68406 Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2025-68406 Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2026-25939

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on...

SUSE CVE-2026-24491

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, videotimer can send client notifications after the control channel is closed, dereferencing a freed callback and triggering a use after free. This vulnerability is fixed in 3.22.0...

SUSE CVE-2026-24677

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecamencodercompressh264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in swsscale. This vulnerability is fixed in 3.22.0...

PT-2026-7575

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5...

PT-2026-7541

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A buffer overflow issue exists in Qsync Central. A remote attacker who obtains a user account can potentially exploit this to alter memory or cause processes to crash. Recommendations Update ...

PT-2026-7535

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4...

PT-2026-7567

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A flaw exists in Qsync Central that could allow a remote attacker to cause a denial-of-service DoS condition. Successful exploitation requires the attacker to obtain administrator account...

PT-2026-7552

Name of the Vulnerable Software and Affected Versions File Station 5 versions prior to 5.5.6.5068 Description A flaw exists where resources can be allocated without limits or throttling. If an attacker obtains administrator access, they may be able to prevent other systems, applications, or...

PT-2026-7538

A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 2026/01/20 and...

PT-2026-7544

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 5.0.0.4 Description A flaw exists in Qsync Central that, if exploited by a remote attacker with a user account, could lead to a denial-of-service DoS attack. The issue is due to a NULL pointer dereference...

VulnCheck KEV: CVE-2026-21859

Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery SSRF vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it do...