CVE-2026-39991
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
50/100
Published: 2026-10-15
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Active
AT:
None
VC:
None
VI:
None
VA:
None
Description
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.12 and later
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| QNAP Systems Inc. | Notes Station 3 | 3.9.x < 3.9.12 |
| QNAP Systems Inc. | Notes Station 3 | 3.9.x < 3.9.12 |
References & Advisories (1)
release-notes