Advisories · Technology

QNAP Systems Inc. QcalAgent.

Every CVE that names QNAP Systems Inc. QcalAgent among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-41544 CVE record

CVSS 8.7 High

Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
- QNAP Systems Inc. QcalAgent
- Path traversal
Not analysed yet 15 Oct 2026
CVE-2024-27123 CVE record

CVSS 5.2 Medium

QcalAgent
- QNAP Systems Inc. QcalAgent
- Cross-site scripting (XSS)
Not analysed yet 18 Sept 2026
CVE-2023-41289 CVE record

CVSS 6.3 Medium

QcalAgent
- QNAP Systems Inc. QcalAgent
- Command injection
Not analysed yet 5 Jan 2024
CVE-2021-38678 CVE record

CVSS 6.1 Medium

Open Redirect Vulnerability in QcalAgent
- QNAP Systems Inc. QcalAgent
- Open redirect
Not analysed yet 14 Jan 2022
CVE-2021-38677 CVE record

CVSS 5.3 Medium

Reflected XSS Vulnerability in QcalAgent
- QNAP Systems Inc. QcalAgent
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2022