QNAP Systems Inc. Notes Station 3

• CVE-2026-39991 Medium 4.8 Stored Cross-Site Scripting (XSS) in Note Station file upload functionality 0.3%
• CVE-2026-34009 High 8.4 **Container Escape** Host user home directory mounted with write access into application container 0.1%
• CVE-2026-34008 High 8.5 **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process <0.1%
• CVE-2026-34007 Medium 6.9 **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()` 1.4%
• CVE-2024-38643 Critical 9.3 Notes Station 3 0.9%
• CVE-2024-38644 High 8.7 Notes Station 3 1.6%
• CVE-2024-38645 Critical 9.4 Notes Station 3 0.6%
• CVE-2024-38646 High 8.4 Notes Station 3 0.2%
• CVE-2024-27126 Medium 6.3 Notes Station 3 0.3%
• CVE-2024-27122 Medium 6.3 Notes Station 3 0.3%