CVE-2025-66276

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

QuTS hero is not affected.

We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-662779.8A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit theCVE-2025-662786.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-662797.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2025-662807.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gaiCVE-2025-662817.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then eCVE-2025-662844.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, anCVE-2025-662864.7An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP reCVE-2025-662878.8A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.CVE-2025-662898.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sCVE-2025-662904.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retriCVE-2025-662914.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint inCVE-2025-662928.1DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /
CVE-2025-66276: Critical severity, CVSS 9.8 | Vulnix