rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-54134 HAX CMS NodeJs's Improper Error Handling Leads to Denial of Service
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-248
description: CWE-248: Uncaught Exception
cwe_id: CWE-703
description: CWE-703: Improper Check or Handling of Exceptional Conditions
Affected products: vendor: haxtheweb
product: issues
Published: 2025-07-21T20:58:35.724Z
CVE-2025-54135 Cursor Agent is vulnerable to prompt injection via MCP Special Files
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-829
description: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: cursor
product: cursor
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-08-05T00:11:07.363Z
CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: cursor
product: cursor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-08-01T23:08:21.817Z
CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
Problem types: cwe_id: CWE-1392
description: CWE-1392: Use of Default Credentials
Affected products: vendor: haxtheweb
product: issues
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-07-22T21:34:20.201Z
CVE-2025-54138 LibreNMS has Authenticated Local File Inclusion in ajax_form.php that Allows RCE
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.
Problem types: cwe_id: CWE-98
description: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: librenms
product: librenms
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-22T21:33:59.149Z
CVE-2025-54139 HAX CMS' application pages are vulnerable to clickjacking
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.
Problem types: cwe_id: CWE-1021
description: CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: haxtheweb
product: issues
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-07-22T23:24:13.334Z
CVE-2025-54140 pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write
pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Execution (RCE), local privilege escalation, system-wide compromise, persistence, and backdoors. This is fixed in version 0.5.0b3.dev90.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: pyload
product: pyload
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-07-22T21:34:30.750Z
CVE-2025-54141 ViewVC's standalone server exposes arbitrary server filesystem content
ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and  1.2.4.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: viewvc
product: viewvc
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-07-22T21:35:47.844Z
CVE-2025-54142 
Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: Akamai
product: AkamaiGhost
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-08-29T00:00:00.000Z
CVE-2025-54143 Sandboxed iframes could allow local downloads despite sandbox restrictions
Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Narendra Bhati
Published: 2025-08-19T20:52:47.450Z
CVE-2025-54144 Internal Firefox open-text URL scheme allowed loading of arbitrary URLs
The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141.
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: James Lee
Published: 2025-08-19T20:52:47.918Z
CVE-2025-54145 Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites
The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141.
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: James Lee
Published: 2025-08-19T20:52:48.366Z
CVE-2025-54146 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:50.129Z
CVE-2025-54147 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:45.923Z
CVE-2025-54148 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:40.809Z
CVE-2025-54149 Qsync Central
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-400
description: CWE-400
cwe_id: CWE-770
description: CWE-770
cwe_id: CWE-789
description: CWE-789
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:34.659Z
CVE-2025-54150 Qsync Central
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-400
description: CWE-400
cwe_id: CWE-770
description: CWE-770
cwe_id: CWE-789
description: CWE-789
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:29.651Z
CVE-2025-54151 Qsync Central
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-400
description: CWE-400
cwe_id: CWE-770
description: CWE-770
cwe_id: CWE-789
description: CWE-789
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:23.495Z
CVE-2025-54152 Qsync Central
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-823
description: CWE-823
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:16.611Z
CVE-2025-54153 Qsync Central
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:14:56.019Z
CVE-2025-54154 QNAP Authenticator
An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QNAP Authenticator 1.3.1.1227 and later
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: QNAP Systems Inc.
product: QNAP Authenticator
default_status: unaffected
Credits: lang: en
value: Andr.Ess
Published: 2025-10-03T18:15:05.561Z
CVE-2025-54155 File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5018 and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:09.363Z
CVE-2025-54156 Santesoft Sante PACS Server Cleartext Transmission of Sensitive Information
The Sante PACS Server Web Portal sends credential information without encryption.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Santesoft
product: Sante PACS Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Chizuru Toyama of TXOne Networks reported these vulnerabilities to CISA.
Published: 2025-08-18T21:21:38.589Z
CVE-2025-54157 
A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:50:06.235Z
CVE-2025-54158 
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-306
description: Missing Authentication for Critical Function
Affected products: vendor: Synology
product: BeeDrive for desktop
default_status: affected
CVSS v3.1: baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
Credits: lang: en
value: Zhao Runzi (赵润梓)
lang: en
value: 李建申（https://lsr00ter.github.io）
Published: 2025-12-04T15:13:29.761Z
CVE-2025-54159 
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Synology
product: BeeDrive for desktop
default_status: affected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
Credits: lang: en
value: Zhao Runzi (赵润梓)
Published: 2025-12-04T15:13:46.771Z
CVE-2025-54160 
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Synology
product: BeeDrive for desktop
default_status: affected
CVSS v3.1: baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
Credits: lang: en
value: Zhao Runzi (赵润梓)
Published: 2025-12-04T15:14:11.401Z
CVE-2025-54161 File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5068 and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:18:01.964Z
CVE-2025-54162 File Station 5
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5068 and later
Problem types: cwe_id: CWE-22
description: CWE-22
cwe_id: CWE-73
description: CWE-73
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:17:56.681Z
CVE-2025-54163 File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5166 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: File Station 5
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:17:51.265Z
CVE-2025-54164 QTS, QuTS hero
An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.7.3256 build 20250913 and later
QuTS hero h5.2.7.3256 build 20250913 and later
QuTS hero h5.3.1.3250 build 20250912 and later
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-01-02T14:56:43.726Z