QNAP Patches 14 Vulnerabilities in QTS, QuTS hero, and QVP Devices

**TL;DR:** QNAP released patches for 14 vulnerabilities across QTS, QuTS hero, QuTS cloud, and QVP — including multiple command-injection flaws, a URL-injection credential theft bug (CVE-2025-59382), pre-auth NULL-pointer and other denial-of-service issues, and buffer overflows; most require authentication but some are exploitable without login. Administrators should apply the published firmware updates, restrict admin access, keep management interfaces off the public internet, and maintain offline backups and snapshots.