Base de CVEs

CVE-2026-44084 Alta · 7.5 CWE-639 15/10/2026

Access Code Forgery in Video Station leading to unauthorized media access

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

CVE-2026-41541 Média · 5.3 CWE-61 15/10/2026

Symlink creation in qsyncsrv.cgi

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

CVE-2026-39997 Alta · 8.9 CWE-306 15/10/2026

Unauthenticated Remote Input Injection in QNAP HD Station's remotepad

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

CVE-2026-39991 Média · 4.8 CWE-79 15/10/2026

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later

CVE-2026-39989 Média · 5.3 CWE-918 15/10/2026

SSRF in QNAP Download Station

A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVE-2026-34015 Média · 6.5 CWE-22 15/10/2026

Remote Code Execution in upload.php of Video Station

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

CVE-2026-34014 Alta · 8.4 CWE-732 15/10/2026

ds-move-files.sh is writable and executed as root

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVE-2026-34009 Alta · 8.4 CWE-653 15/10/2026

**Container Escape** Host user home directory mounted with write access into application container

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34008 Alta · 8.5 CWE-732 15/10/2026

**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34007 Média · 6.9 CWE-78 15/10/2026

**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVE-2026-34006 Crítica · 9.3 CWE-306 15/10/2026

Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later

CVE-2026-26245 Alta · 8.8 CWE-89 15/10/2026

SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

CVE-2026-26244 Alta · 8.8 CWE-89 15/10/2026

SQLi#1 SQL Injection in class_videos.php _getFilters

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

CVE-2026-26243 Alta · 7.2 CWE-22 15/10/2026

Arbitrary Folder Deletion in Qsync Central 5.0.0.5

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later

CVE-2026-19864 Média · 5.6 CWE-312 15/10/2026

Cleartext Storage of Sensitive Information em Eclipse Foundation Org.eclipse.jetty:jetty-security

Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

CVE-2026-19863 Crítica · 9.3 CWE-288 15/10/2026

Authentication Bypass Using an Alternate Path or Channel em Eclipse Foundation Org.eclipse.jetty:jetty-ethereum

An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.

CVE-2026-18662 Média · 6.9 CWE-863 15/10/2026

Incorrect Authorization em Eclipse Foundation Org.eclipse.jetty.ee11:jetty-ee11-servlet

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

CVE-2026-18660 Alta · 8.8 CWE-178 15/10/2026

Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

CVE-2026-18659 Média · 6.9 CWE-863 15/10/2026

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

CVE-2026-96614 Média · 5.4 CWE-939 15/10/2026

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler…

"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.

CVE-2026-79823 Média · 4.0 CWE-121 15/10/2026

HPE NonStop EMS Distributor - Buffer Overflow vulnerability

HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.

CVE-2026-77711 Alta · 8.2 CWE-200 15/10/2026

Exposure of Sensitive Information em Eclipse Foundation Jetty

When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.

CVE-2026-76184 Alta · 8.2 CWE-200 15/10/2026

Exposure of Sensitive Information em Eclipse Foundation Jetty

In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.

CVE-2026-76182 Média · 6.9 CWE-74 15/10/2026

Injection em Eclipse Foundation Jetty

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.

CVE-2026-75559 Média · 5.3 CWE-201 15/10/2026

Insertion of Sensitive Information Into Sent Data em Ministry of Land, Infrastructure, Transport and Tourism Vehicle Inspection Certificate Viewer (for Android)

The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key.