CVE-2025-59382

LowCVSS 1.2/10Last modified Jul 23, 2026

Description

QTS, QuTS hero, QuTScloud are not affected.

We have already fixed the vulnerability in the following version:

Metrics

CVSS 4.0 1.2/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-472

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jul 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-593839.1A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability CVE-2025-593847.5A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contCVE-2025-593859.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers CVE-2025-593864.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-593878.1An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit CVE-2025-593889.8A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulneCVE-2025-593899.8An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to CVE-2025-59394.4The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includinCVE-2025-593909.8Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuCVE-2025-593916.5A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds CVE-2025-593926.8On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (coCVE-2025-593975.0Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.
CVE-2025-59382: Low severity, CVSS 1.2 | Vulnix