What’s Vulnerable › Products

QNAP Systems Inc. Notes Station 3 vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your QNAP Systems Inc. Notes Station 3 version is affected

Latest QNAP Systems Inc. Notes Station 3 vulnerabilities

• CVE-2026-34009 — **Container Escape** Host user home directory mounted with write access into application container (CVSS 8.4)
• CVE-2026-34008 — **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process (CVSS 8.5)
• CVE-2026-34007 — **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()` (CVSS 6.9)
• CVE-2026-39991 — Stored Cross-Site Scripting (XSS) in Note Station file upload functionality (CVSS 4.8)
• CVE-2024-38646 — Notes Station 3 (CVSS 6.0)
• CVE-2024-38645 — Notes Station 3 (CVSS 6.5)
• CVE-2024-38644 — Notes Station 3 (CVSS 8.8)
• CVE-2024-38643 — Notes Station 3 (CVSS 9.8)
• CVE-2024-27126 — Notes Station 3 (CVSS 5.4)
• CVE-2024-27122 — Notes Station 3 (CVSS 5.4)