https://patchfirst.co/vendor/qnap/New and newly exploited QNAP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-47786/CVE-2026-47786Thu, 15 Oct 2026 00:00:00 GMTQNAP Systems Inc. · HybridDesk Station. Not in CISA KEV. EPSS 1.1% (higher than 64.8% of CVEs). CVSS 9.3 CRITICAL. Priority 21.7 of 100.https://patchfirst.co/cve/CVE-2026-50619/CVE-2026-50619Thu, 15 Oct 2026 00:00:00 GMTQNAP Systems Inc. · Qsirch. Not in CISA KEV. EPSS 0.4% (higher than 37.2% of CVEs). CVSS 9.3 CRITICAL. Priority 16.2 of 100.https://patchfirst.co/cve/CVE-2026-34006/CVE-2026-34006Thu, 15 Oct 2026 00:00:00 GMTQNAP Systems Inc. · sMedio DTCP MOVE. Not in CISA KEV. EPSS 0.4% (higher than 33.7% of CVEs). CVSS 9.3 CRITICAL. Priority 15.5 of 100.https://patchfirst.co/cve/CVE-2026-50612/CVE-2026-50612Thu, 15 Oct 2026 00:00:00 GMTQNAP Systems Inc. · QuMagie. Not in CISA KEV. EPSS 0.4% (higher than 31.8% of CVEs). CVSS 9.4 CRITICAL. Priority 15.2 of 100.https://patchfirst.co/cve/CVE-2025-11837/CVE-2025-11837Fri, 02 Jan 2026 00:00:00 GMTQNAP Systems Inc. · Malware Remover. Not in CISA KEV. EPSS 1.5% (higher than 74.6% of CVEs). CVSS 8.1 HIGH. Priority 63.0 of 100.https://patchfirst.co/cve/CVE-2017-20210/CVE-2017-20210Tue, 11 Nov 2025 00:00:00 GMTQNAP Systems Inc. · Photo Station. Not in CISA KEV. EPSS 0.4% (higher than 30.9% of CVEs). CVSS 9.8 CRITICAL. Priority 48.0 of 100.https://patchfirst.co/cve/CVE-2023-45038/CVE-2023-45038Fri, 06 Sep 2024 00:00:00 GMTQNAP Systems Inc. · Music Station. Not in CISA KEV. EPSS 1.2% (higher than 69.2% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. Priority 56.9 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-27130/CVE-2024-27130Tue, 21 May 2024 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 37.5% (higher than 98.5% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. Priority 64.7 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-21899/CVE-2024-21899Fri, 08 Mar 2024 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 24.4% (higher than 97.9% of CVEs). CVSS 9.8 CRITICAL. Priority 61.4 of 100.https://patchfirst.co/cve/CVE-2023-47218/CVE-2023-47218Tue, 13 Feb 2024 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 89.9% (higher than 99.79% of CVEs). CVSS 5.8 MEDIUM. Public exploit code exists. Priority 66.1 of 100.public-exploithttps://patchfirst.co/cve/CVE-2023-50358/CVE-2023-50358Tue, 13 Feb 2024 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 13.5% (higher than 96.4% of CVEs). CVSS 5.8 MEDIUM. Priority 59.7 of 100.https://patchfirst.co/cve/CVE-2023-39296/CVE-2023-39296Fri, 05 Jan 2024 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 1.6% (higher than 75.3% of CVEs). CVSS 7.5 HIGH. Priority 55.3 of 100.https://patchfirst.co/cve/CVE-2023-47565/CVE-2023-47565#kevThu, 21 Dec 2023 00:00:00 GMTQNAP · VioStor NVR. In CISA KEV since 2023-12-21. ENISA EUVD lists it as exploited. EPSS 73.3% (higher than 99.46% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1496 Resource Hijacking; T1498 Network Denial of Service. Priority 64.1 of 100.kevT1496T1498https://patchfirst.co/cve/CVE-2022-27593/CVE-2022-27593#kevThu, 08 Sep 2022 00:00:00 GMTQNAP · Photo Station. In CISA KEV since 2022-09-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 87.9% (higher than 99.76% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 79.3 of 100.kevransomwarepublic-exploitT1190T1565.001https://patchfirst.co/cve/CVE-2019-7195/CVE-2019-7195#kevWed, 08 Jun 2022 00:00:00 GMTQNAP · Photo Station. In CISA KEV since 2022-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 89.3% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2019-7194/CVE-2019-7194#kevWed, 08 Jun 2022 00:00:00 GMTQNAP · Photo Station. In CISA KEV since 2022-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 82.7% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2019-7192/CVE-2019-7192#kevWed, 08 Jun 2022 00:00:00 GMTQNAP · Photo Station. In CISA KEV since 2022-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 88.1% (higher than 99.77% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2019-7193/CVE-2019-7193#kevWed, 08 Jun 2022 00:00:00 GMTQNAP · QTS. In CISA KEV since 2022-06-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 14.4% (higher than 96.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.2 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2018-19949/CVE-2018-19949#kevTue, 24 May 2022 00:00:00 GMTQNAP · Network Attached Storage (NAS). In CISA KEV since 2022-05-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.2% (higher than 98.2% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.5 of 100.kevransomwareT1190T1059https://patchfirst.co/cve/CVE-2018-19953/CVE-2018-19953#kevTue, 24 May 2022 00:00:00 GMTQNAP · Network Attached Storage (NAS). In CISA KEV since 2022-05-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.5% (higher than 98.2% of CVEs). CVSS 6.1 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1059.007 JavaScript. Priority 71.9 of 100.kevransomwareT1189T1059.007https://patchfirst.co/cve/CVE-2018-19943/CVE-2018-19943#kevTue, 24 May 2022 00:00:00 GMTQNAP · Network Attached Storage (NAS). In CISA KEV since 2022-05-24, known ransomware use. ENISA EUVD lists it as exploited. EPSS 22.7% (higher than 97.7% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1189 Drive-by Compromise; T1059.007 JavaScript. Priority 71.3 of 100.kevransomwareT1189T1059.007https://patchfirst.co/cve/CVE-2020-2509/CVE-2020-2509#kevMon, 11 Apr 2022 00:00:00 GMTQNAP · QNAP Network-Attached Storage (NAS). In CISA KEV since 2022-04-11. ENISA EUVD lists it as exploited. EPSS 34.0% (higher than 98.4% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.5 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-28799/CVE-2021-28799#kevThu, 31 Mar 2022 00:00:00 GMTQNAP · Network Attached Storage (NAS). In CISA KEV since 2022-03-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.3% (higher than 99.58% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2020-2506/CVE-2020-2506#kevFri, 25 Mar 2022 00:00:00 GMTQNAP Systems · Helpdesk. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 61.0 of 100.kevT1190T1068https://patchfirst.co/cve/CVE-2020-36198/CVE-2020-36198Thu, 13 May 2021 00:00:00 GMTQNAP Systems Inc. · Malware Remover. Not in CISA KEV. EPSS 1.1% (higher than 66.2% of CVEs). CVSS 6.7 MEDIUM. Public exploit code exists. Priority 69.0 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-36195/CVE-2020-36195Sat, 17 Apr 2021 00:00:00 GMTQNAP Systems Inc. · QTS. Not in CISA KEV. EPSS 1.8% (higher than 78% of CVEs). CVSS 9.8 CRITICAL. Priority 67.5 of 100.https://patchfirst.co/cve/CVE-2020-2507/CVE-2020-2507Wed, 03 Feb 2021 00:00:00 GMTQNAP Systems Inc. · Helpdesk. Not in CISA KEV. EPSS 3.1% (higher than 87.7% of CVEs). CVSS 9.8 CRITICAL. Priority 59.4 of 100.https://patchfirst.co/cve/CVE-2018-0707/CVE-2018-0707Mon, 16 Jul 2018 00:00:00 GMTQNAP · Q'center Virtual Appliance. Not in CISA KEV. EPSS 58.8% (higher than 99.11% of CVEs). Public exploit code exists. Priority 24.8 of 100.public-exploit