Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 26, 2026A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS CVE-2026-77550 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 10
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certCVE-2026-77549 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain deviCVE-2026-77545 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a CVE-2026-77540 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a CVE-2026-77539 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OSCVE-2026-77536 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OSCVE-2026-77534 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS toCVE-2026-55110 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalCVE-2026-54404 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.8
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of CVE-2026-54403 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command CVE-2026-54402 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS dCVE-2026-54401 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.7
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi CVE-2026-47370 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi CVE-2026-47369 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniCVE-2026-47368 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the unCVE-2026-34911 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.7
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Ubiquiti UniFi OS Improper Input Validation VulnerabilityCVE-2026-34910 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
- Product
- UniFi OS
- On CISA’s list since
- Jun 23, 2026 (federal fix deadline Jun 26, 2026)
- What to do
- Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.ui.comcisa.gov
May 21, 2026Ubiquiti UniFi OS Path Traversal VulnerabilityCVE-2026-34909 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
- Product
- UniFi OS
- On CISA’s list since
- Jun 23, 2026 (federal fix deadline Jun 26, 2026)
- What to do
- Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.ui.comcisa.gov
May 21, 2026Ubiquiti UniFi OS Improper Access Control VulnerabilityCVE-2026-34908 · Network & remote access · Ubiquiti · reported by support@hackerone.comExploitedCritical 10
Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
- Product
- UniFi OS
- On CISA’s list since
- Jun 23, 2026 (federal fix deadline Jun 26, 2026)
- What to do
- Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcommunity.ui.comcisa.gov
May 21, 2026A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute aCVE-2026-33000 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2025An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM)CVE-2025-23091 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comMedium 5.9
An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update.
- Product
- UDM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB.CVE-2023-31997 · Network & remote access · Ubiquiti Inc. · reported by support@hackerone.comCritical 9
UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. "Applicable Cloud Keys" include the following: Cloud Key Gen2 and Cloud Key Gen2 Plus.
- Product
- UniFi OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
May 11, 2023A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by CVE-2023-28361 · Other software · UNI · reported by support@hackerone.comMedium 6.5
A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.
- Product
- Unifi OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.