Approved changes feed: RSS · Atom
cpe:2.3:a:qnap_systems_inc.:qcalagent:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Qnap Systems Inc. (1f66ac1e-0889-51bf-b27f-24c7175e5920) |
|---|---|
| Product | Qcalagent (bcf7aff4-9178-5c93-af7a-2efeb1b620b7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41544 |
vulnerable | 2026-11-03 10:17:06.059681 |
Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.10 and later
Published: 2026-10-15T07:00:14.196Z
Updated: 2026-10-19T02:05:29.256Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27123 |
vulnerable | 2026-10-13 12:40:59.014303 |
QcalAgent
A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.9 and later
Published: 2026-09-18T06:49:37.920Z
Updated: 2026-09-18T14:31:44.541Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41289 |
vulnerable | 2026-06-08 06:11:05.840355 |
QcalAgent
MEDIUM (6.3)
An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following version:
QcalAgent 1.1.8 and later
Published: 2024-01-05T16:19:05.701Z
Updated: 2025-06-17T20:29:12.127Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38678 |
vulnerable | 2026-06-08 05:33:48.283834 |
Open Redirect Vulnerability in QcalAgent
MEDIUM (6.1)
An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
Published: 2022-01-14T01:00:17.962Z
Updated: 2024-09-17T03:59:41.622Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38677 |
vulnerable | 2026-06-08 05:33:48.282783 |
Reflected XSS Vulnerability in QcalAgent
MEDIUM (5.3)
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
Published: 2022-01-14T01:00:16.519Z
Updated: 2024-09-17T01:10:31.762Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.