CVE-2026-34007Medium· 6.9▾ SunlitAn OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following vers…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.
We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
notes_station_3 >= 3.9.x < 3.9.11We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34008High· 8.5**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
CVE-2026-39991Medium· 4.8Stored Cross-Site Scripting (XSS) in Note Station file upload functionality
CVE-2026-34009High· 8.4**Container Escape** Host user home directory mounted with write access into application container
CVE-2026-41545High· 8.6WebSocket timelapse path traversal and command injection
CVE-2026-47786Critical· 9.3Pre-Authentication Command Injection
CVE-2026-34006Critical· 9.3Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer